v1.22.1: CodeQL security hardening and code scanning remediation

Security & Code Quality Hardening

• CWE-457 Uninitialized Variables Fixed: Refactored container inspection test logic in test_ingress_labels.py to eliminate uninitialized variable paths.
• CWE-20 Webhook URL Sanitization: Upgraded detect_webhook_type() in notifications.py to use urllib.parse.urlsplit for strict hostname validation, mitigating substring matching bypasses.
• CWE-116 HTML Sanitization Refactoring: Replaced regex-based <script> extraction with standard library html.parser.HTMLParser in test helpers (test_dashboard_dom_sanitization.py).
• CodeQL Quality Invariants:
  • Explicit __all__ exports declared across all historical compatibility modules (app.py, reconcile.py, notifications.py, metrics.py, validation.py).
  • Added clarifying comments to all 18 empty except blocks across adapters, application, domain, and web layers.
  • Replaced ellipsis literals in Protocol interface methods with raise NotImplementedError and added docstrings to @overload signatures in settings.py.
  • Refactored assertions in test contracts from generic boolean comparisons to assertEqual and assertGreater.
• OpenSSF Scorecard Hardening:
  • Restricted top-level workflow token permissions to read-all in .github/workflows/osv-scanner.yml.
  • Added repository-root SECURITY.md with structured vulnerability disclosure policies, SLAs, and contact details.

Validation & Reviews

• Full regression suite verified: 364 tests passing across Python 3.11, 3.12, 3.13, and 3.14.
• All 10 CI checks passing green, including CodeQL Analysis.
• Code review approved by @MustermenschAlex in PR #192.