feat(tyr): add cloudbuild security gate configuration

cloudbuild.yaml

@@ -8,15 +8,21 @@ steps:
       - |
         pip install flake8
         echo "--- Running static analysis on TYR tools ---"
-        flake8 tyr/tools/
+        flake8 --ignore=E501,W291,W293 tyr/tools/
 
   # Step 2: Run scan_tyr_surface.py to check GCP environment compliance.
   # NOTE: This step requires a custom build image with gcloud, python, the required
   # python libraries, and spire binaries installed. It also needs appropriate permissions.
   - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk' # Placeholder image
     id: 'SurfaceScan'
-    entrypoint: 'python3'
-    args: ['tyr/tools/scan_tyr_surface.py']
+    entrypoint: 'bash'
+    args:
+      - '-c'
+      - |
+        python3 -m venv /tmp/venv
+        source /tmp/venv/bin/activate
+        pip install google-cloud-secret-manager google-cloud-bigquery
+        python3 tyr/tools/scan_tyr_surface.py
 
   # Step 3: Run attest_tyr_supply_chain.py against a built container image.
   # NOTE: This step requires a custom build image with cosign. It would run after