Make scan pipeline step use scan.yml as reusable workflow

[HendrikSchmidt]

At the moment, there is code duplication between the pipeline.yml vulnerability scan step and scan.yml. We could probably make scan.yml a reusable workflow and use it as a step in pipeline.yml.

Steps:

1. Figure out why the vulnerability scan step in pipeline.yml doesn't check the code out, but scan does?
2. Make scan.yml a resuable workflow.
3. Call this workflow from pipeline.yml.