We already have a FIPS scanner job for 2.x and we should run this also against 3.0

AC:

• investigate how the FIPS scanner is run in CVP
• if the coverage in the CVP is sufficient, we don't have to run our own scanner
• if the coverage in the CVP is not sufficient, we have to run our own scanner on each release candidate