fix: patch dependency vulnerabilities and deploy migration bug

Update filament, laravel/framework, dompdf, guzzle/psr7, league/commonmark,
phpseclib, and sodium_compat to versions patching GitHub-flagged advisories
(MFA recovery code reuse, unauthenticated temp file upload, XSS, CRLF
injection, SSRF, DoS). Apply equivalent npm audit fixes.

Fix deploy.yml: RUN_MIGRATIONS/RUN_SCOUT_IMPORT were escaped inside the SSH
heredoc, so they evaluated on the remote shell where they're never set —
migrations silently never ran on deploy regardless of the workflow input.

Add npm audit to CI security job and a CodeQL workflow (previously no code
scanning was configured for the repo).

Author: AdilAzhari

.github/workflows/ci.yml

@@ -158,5 +158,17 @@ jobs:
       - name: Install dependencies
         run: composer install --prefer-dist --no-interaction --no-progress --no-scripts
 
-      - name: Run security audit
+      - name: Run PHP security audit
         run: composer audit --no-dev
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "npm"
+
+      - name: Install Node dependencies
+        run: npm ci
+
+      - name: Run npm security audit
+        run: npm audit --audit-level=high

.github/workflows/codeql.yml

@@ -0,0 +1,36 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "17 3 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [php, javascript-typescript]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/deploy.yml

@@ -150,15 +150,15 @@ jobs:
             \$PHP artisan view:cache
             \$PHP artisan event:cache
 
-            if [ "\$RUN_MIGRATIONS" = "true" ]; then
+            if [ "$RUN_MIGRATIONS" = "true" ]; then
               echo "==> Running database migrations"
               \$PHP artisan migrate --force
             fi
 
             echo "==> Restarting queue workers"
             \$PHP artisan queue:restart
 
-            if [ "\$RUN_SCOUT_IMPORT" = "true" ]; then
+            if [ "$RUN_SCOUT_IMPORT" = "true" ]; then
               echo "==> Re-indexing Typesense"
               \$PHP artisan scout:flush  "App\Domain\Product\Models\Product"
               \$PHP artisan scout:import "App\Domain\Product\Models\Product"