Add a low-frequency (monthly + manual) security workflow that resolves
dependencies with uv and audits them against the OSV / PyPI Advisory DB
via pip-audit, failing the job when a vulnerability is found.
Also add Dependabot (pip + github-actions, monthly) to auto-open PRs
that bump dependencies to fixed versions. PRs are review/merge by hand
(no auto-merge) since there is no test-gating CI yet.
Closes#11
