fix: add xyz dll security audit guard

[TJCurnutte]

Summary

/claim #9

Adds a repository-level security guard for the vulnerable xyz.dll artifact reported in issue #9.

Changes

• adds security/denylist.json with xyz.dll blocked
• adds scripts/security-audit.mjs to scan source paths and filenames for blocked artifacts
• adds npm run security:audit as a repeatable validation command
• documents the guardrail in SECURITY.md

Validation

• npm run security:audit
• node --check scripts/security-audit.mjs
• git diff --check

Collision check

Immediately before implementation:

• issue test issue usinf xyz dlll  #9 was open and unassigned
• bounty bot comment listed a $1000 CodeBounty bounty
• no open PRs matched issue test issue usinf xyz dlll  #9 / xyz / dll / security