[Security hardening] Add automated security audit checks for Python dependencies and static analysis

[PascalThuet]

Summary

Add lightweight automated security checks to CI for Python dependency vulnerabilities and static-analysis findings.

Why

Manual audit runs are useful, but dependency and static-analysis checks should be repeatable in CI. pip-audit can catch known Python package vulnerabilities, and Bandit can flag Python security-sensitive patterns for review.

Proposed direction

• Add a CI job or workflow for pip-audit.
• Add a Bandit job configured for actionable findings.
• Keep initial scope focused so the signal is useful and does not fail on low-value noise.
• Document how to run the checks locally.

Acceptance criteria

• CI runs dependency vulnerability checks.
• CI runs Python static security checks with an explicit configuration.
• The current dependency set passes the audit.
• Any intentionally accepted Bandit findings are documented or excluded explicitly.