CI: allow the runner to set a NVD API key

Setting an API key means we get higher rate limits. Because keys are
private, the key must be set in the environment of the runner.

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>

ci/cve.yml

@@ -5,6 +5,9 @@ local_conf_header:
   cve: |
     INHERIT += "cve-check"
 
+    # Allow the runner environment to provide an API key
+    NVDCVE_API_KEY = "${@d.getVar('BB_ORIGENV').getVar('NVDCVE_API_KEY') or ''}"
+
     # Just show the warnings for our layers
     CVE_CHECK_SHOW_WARNINGS = "0"
     CVE_CHECK_SHOW_WARNINGS:layer-arm-toolchain = "1"