Spikes for Security Orchestration Policy: how to enforce having given scan in your pipeline