fix: sync pyproject.toml dependencies with requirements.txt and add CodeQL SAST workflow

[namann5]

Summary

The pyproject.toml declares runtime dependencies that are inconsistent with backend/requirements.txt. Three critical packages — cryptography, httpx, and openai — are present in requirements.txt but missing from pyproject.toml.

This means any installation via pip install . or future PyPI publication silently omits these packages, causing runtime failures in core features:

Missing Package	Broken Feature	Impact
cryptography>=42.0.0	VaultCrypto AES-256-GCM encryption (backend/secuscan/vault.py)	Credential vault raises ImportError; all stored secrets become inaccessible
httpx>=0.28.1	Webhook notification delivery (backend/secuscan/notification_service.py)	All webhook/Slack notifications silently fail
openai>=1.0.0	AI Executive Summary (backend/secuscan/ai_summary.py)	AI summary feature raises ImportError at call time

Steps to Reproduce

1. pip install . (or create a fresh venv and install from pyproject.toml)
2. Start SecuScan
3. Attempt to use the credential vault, webhook notifications, or AI summary
4. Observe ModuleNotFoundError / ImportError at runtime

Root Cause

pyproject.toml at line 11-22 lists 11 dependencies. backend/requirements.txt at line 2, 13-14 lists 3 additional packages (cryptography, httpx, openai) that are imported and used at runtime but never declared in the project metadata.

Proposed Fix

PR adds the missing dependencies to pyproject.toml:

dependencies = [
    ...
    "cryptography>=42.0.0",
    "httpx>=0.28.1",
    "openai>=1.0.0",
]

Additionally adds a CodeQL security analysis workflow for CI SAST scanning and a .python-version file for consistent local development.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[utksh1]

Thanks for the work here. This PR needs to be reshaped before merge:\n\n1. The dependency-sync part appears stale on current main, and parts of it would actually regress declarations (for example, changing httpx[cli] to plain httpx).\n2. The CodeQL workflow may be valuable, but it should be proposed in a clean, focused PR instead of being bundled with an obsolete dependency-sync change.\n3. Please rebase on current main and resubmit only the still-relevant part of this work.\n\nIf you want to keep the CodeQL addition, open a single-purpose PR for that alone.