Add security dependency check to CI

[Arvuno]

Summary

Adds security hardening to CI by introducing a dedicated workflow that scans dependencies for vulnerabilities.

Changes

• New workflow: .github/workflows/security-dependencies.yml
• pip-audit: Scans Python dependencies for known vulnerabilities with strict hash checking
• safety: Additional security check for dependency vulnerabilities
• Dependency review: Detects changes to pyproject.toml and requirements.txt in PRs

Why this matters

• Prevents introducing vulnerable dependencies into the project
• Scans all dependencies (including transitive) for CVEs
• Enforces strict mode with hash requirements for reproducible builds
• Provides early warning of security issues in CI rather than production

Notes

• Uses continue-on-error: true to prevent blocking merges while still reporting issues
• Can be extended with Dependabot for automated dependency updates

---