prevent non scanned images from being pulled

Today "prevent vulnerable images from running" does not take into account images where the scans were not run.

This is a security issue. Upstream ticket: https://github.com/goharbor/harbor/issues/16218