ci: add comprehensive security scanning to pipeline

[Andreschuks101]

Description

The CI pipeline previously had only basic Trivy filesystem scanning. This PR adds
dependency auditing, secret scanning, static analysis (SAST), dependency review, and
automated dependency updates so vulnerabilities are caught before reaching production.

Closes #79

Changes

CI pipeline (.github/workflows/ci.yml)

• New dependency-audit job runs npm audit --audit-level=high for both backend and
  frontend on every push and PR, failing the build on high/critical advisories.
• New cargo-audit job installs cargo-audit and audits the contracts crate.
• Existing Trivy scan retained.

Dedicated security workflow (.github/workflows/security.yml)

• CodeQL static analysis (SAST) with the security-extended query suite for
  javascript-typescript and rust, results uploaded to the Security tab.
• Gitleaks secret scanning over full history to prevent committed credentials.
• Dependency Review on pull requests, failing on high severity with a PR summary.
• npm audit matrix (backend + frontend) and cargo audit for contracts.
• Trivy filesystem/dependency scan (CRITICAL/HIGH) uploaded as SARIF.
• Triggered on pushes and PRs to main/develop, plus a weekly scheduled scan.

Automated dependency updates (.github/dependabot.yml)

• Weekly updates for backend, frontend, and root npm workspaces, the contracts cargo
  crate, and GitHub Actions, with grouping and labels.

Security policy (.github/SECURITY.md)

• Private vulnerability reporting process, response commitments, coordinated disclosure
  policy, scope, and an overview of the automated tooling.

Audit scripts (backend/package.json, frontend/package.json)

• Added audit, audit:fix, and audit:ci scripts so contributors can run the same
  checks locally.

Type of change

• CI/CD and security tooling

Notes

• Audit and SAST results surface directly in PR checks and the repository Security tab.
• CodeQL Rust analysis uses build-mode: none (source-based) per the current CodeQL
  support; enable GitHub secret scanning / push protection in repository settings to
  complement the Gitleaks workflow.

Checklist

• npm audit runs on every PR for backend and frontend, failing on high/critical
• cargo audit runs for contract dependencies
• CodeQL analysis enabled for JavaScript, TypeScript, and Rust
• Dependabot configured for weekly updates across all ecosystems
• Secret scanning (Gitleaks) added to prevent committed credentials
• Security results visible in PR checks and the Security tab
• .github/SECURITY.md documents the vulnerability reporting process

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[jobbykings]

@Andreschuks101 Hey! Thanks for the PR. It looks like a couple of the CI/CD checks are failing. Could you take a look at the logs, push a fix, and get them green

[jobbykings]

@Andreschuks101 "Hey! Thanks for the PR. It looks like a couple of the CI/CD checks are failing. Could you take a look at the logs, push a fix, and get them green?

[Andreschuks101]

@jobbykings thanks for your response . The CI/CD checks have all successfully passed now.