Automated dependency vulnerability

[gloskull]

Motivation
Add an automated, CI-enforced dependency vulnerability scanning pipeline to detect and surface high/critical npm advisories and OSV lockfile findings for this frontend service.
Description
Add a new workflow Dependency Vulnerability Scan that runs on dependency-changing PRs, scheduled weekdays, pushes to main, and manual dispatches and that runs npm audit (JSON) and an OSV lockfile scan with SARIF upload.
Add scripts/summarize-npm-audit.mjs to convert npm audit --json output into a concise Markdown summary with severity totals, fix availability, and top vulnerable packages.
Upload raw artifacts for 30 days and comment the audit summary on PRs, and fail the OSV job when the scanner reports vulnerabilities.
Add documentation and a runbook at docs/dependency-vulnerability-scanning.md and docs/runbooks/dependency-vulnerability-scanning.md, and expose a local helper script via package.json as audit:security.
Testing
Ran npx eslint scripts/summarize-npm-audit.mjs which succeeded for the new script.
Ran the summary generator with a sample audit JSON using node scripts/summarize-npm-audit.mjs which produced the expected Markdown output.
Ran npm run lint which failed due to pre-existing unrelated lint errors in src/components/map/AssetHeatmapLayer.tsx.
Ran npm test which failed due to pre-existing unrelated unit/test failures in tests/components/AssetHeatmapLayer.test.tsx and tests/unit/keyCache.test.ts.
Ran npm run build which failed in this environment because next/font could not fetch Google Fonts.
Ran npm run audit:security which failed here because the npm audit endpoint returned 403 Forbidden in this environment.
Closes #125

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.