the security-scan.hcl is a declarative file where the security-scanner (owned by Security) will attempt to find in your repo. In each of the two stanzas container and binary there are options that are set to true/false to allow the scanner to read and detect any vulns/CVEs that may arise. If any of those vulns arise, then the workflows will stop and output the vulnerability.
here’s a link to more in depth explanation for that config file: https://github.com/hashicorp/security-scanner/blob/main/CONFIG.md