ci: Add a security workflow

[steven-sheehy]

Description:

• Add a security workflow that runs:
  • CodeQL to provide static code analysis
  • PNPM audit to fail if any dependency has a high or critical vulnerability
  • Semgrep to provide additional static code analysis
• Bump solo and kind versions
• Change release workflow to a single command to set versions and update dependencies
• Change workflows to read PNPM and Node.js versions from package.json

Related issue(s):

Fixes #2852

Notes for reviewer:

Checklist

• Documented (Code comments, README, etc.)
• Tested (unit, integration, etc.)

[swirlds-automation]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.98%. Comparing base (f4ef5c7) to head (cdc7636).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2859      +/-   ##
==========================================
+ Coverage   99.97%   99.98%   +0.01%     
==========================================
  Files         116      184      +68     
  Lines        3590     5689    +2099     
  Branches      615      998     +383     
==========================================
+ Hits         3589     5688    +2099     
  Misses          1        1              

see 69 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.