trivy-check-tar accepts both tar files and registry images