feat(ci): add Checkov security scanning workflow

[t0mmylam]

Summary

Adds automated security scanning using Checkov to detect infrastructure security issues in PRs.

Depends on #96

Changes

• Add .github/workflows/security-checkov.yaml workflow
• Scans Dockerfiles, Kubernetes manifests, and Helm charts
• Excludes test directories to reduce noise
• Triggers on PR and push to main

Implementation

• Uses official bridgecrewio/checkov-action@master
• Minimal inline configuration
• CLI output format
• No additional config files required

Workflow will run automatically on this PR and future changes.

[ayuskauskas]

Can you add a dummy change to the chart to make sure checkov does run and that it passes. I don't want to merge a check that will immediately block the next PR.

[t0mmylam]

Can you add a dummy change to the chart to make sure checkov does run and that it passes. I don't want to merge a check that will immediately block the next PR.

This PR actually won't get merged until all the fixes get resolved due to this reason. I probably should've made that clear or waited before opening this.

[ayuskauskas]

We should just merge this into the other one then. That way that PR can known to be good before merging.