feat(ci): add Dependabot and Trivy image scanning (closes #368, closes #372)

[Eleora57]

Closes #372
Closes #368

Summary

Adds automated dependency updates (Dependabot) and Docker image vulnerability scanning (Trivy) to close #368 and #372 in a single change-set.

• .github/dependabot.yml — weekly schedule with grouped updates (@nestjs/*, @opentelemetry/*, react/next, @radix-ui/*) for all 5 package.json locations (root, api, app, xstreamroll-sdk, xstreamroll-processing).
• .github/workflows/docker-scan.yml — Trivy scan of every image with SARIF uploads to GitHub Code Scanning, fails on CRITICAL, weekly re-scan of published ghcr.io images; paths-filtered so unrelated PRs are skipped.
• .github/workflows/dependabot-auto-merge.yml — enables squash auto-merge for Dependabot patch and security PRs once CI is green.
• .trivyignore — starter file documenting the suppression format.
• CHANGELOG.md — [Unreleased] entries referencing both issues.

Note on the "immediate updates for security advisories" AC: that requirement is satisfied by the repo-level Settings → Code security and analysis → Dependabot security updates toggle (separate from this YAML), and the resulting security-update PRs are picked up by the auto-merge workflow above. A comment block at the top of dependabot.yml makes that explicit.

Related issues

Closes: #368
Closes: #372

Type of change

• feat
• fix
• docs
• chore
• test
• ci

Testing performed

• python3 -c "import yaml; yaml.safe_load(open(f).read())" against all new YAML files → OK.
• Verified aquasecurity/trivy-action@0.28.0, dependabot/fetch-metadata@v2, github/codeql-action/upload-sarif@v3, docker/{setup-buildx,login,build-push}-action@v3/v6, actions/github-script@v7 are valid published versions.
• docker-scan.yml matrix entries matched against the three Dockerfiles (api/Dockerfile, app/Dockerfile, xstreamroll-processing/Dockerfile).
• dependabot-auto-merge.yml checks github.event.pull_request.user.login == "dependabot[bot]" and gates on version-update:semver-patch / security-update only.
• Did not run npm run lint/npm test for these files — no source code was changed, only GitHub-Actions configuration and changelog.

Screenshots (if applicable)

N/A (infrastructure-only change).

Checklist — author

• I rebased onto origin/main and resolved conflicts.
• I ran the quality gates locally: npm run lint, npm run build, npm test. (N/A for this change-set; only YAML/changelog touched)
• Title follows Conventional Commits and references the issue (see above).
• I added/updated tests where applicable and they pass locally. (N/A — no source code changed)
• No new TypeScript errors or lint warnings introduced.
• I updated documentation if the change affects public behavior. (CHANGELOG.md + .trivyignore comments)
• Screenshots included for UI changes.

Checklist — reviewer guidance

Reviewer should additionally verify:

1. Repository setting Allow auto-merge is enabled (Settings → General → Pull Requests) for the dependabot-auto-merge.yml workflow to take effect. Documented in the workflow header.
2. Repository setting Dependabot security updates is enabled (Settings → Code security and analysis) for the "immediate updates for security advisories" AC of infra: No Dependabot or Renovate configuration for automated dependency updates #368. Commented in dependabot.yml.
3. The first docker-scan.yml run on push to main will populate the Trivy Code Scanning dashboard.
4. The weekly scheduled scan (cron: "0 6 * * 1") needs the workflow file present on main to take effect; after merge it will fire on the next Monday 06:00 UTC.