Enhance security and CI workflows for vulnerability management

[liudger]

This pull request introduces several improvements focused on security, code quality, and development workflow automation. The most significant changes are the addition of new GitHub Actions workflows for dependency review, supply-chain security (Scorecard), and type checking, as well as the introduction of a dedicated security policy document. There are also minor updates to the .editorconfig file to standardize YAML indentation.

Security and Policy Enhancements:

• Added a comprehensive SECURITY.md policy outlining supported versions, reporting process, disclosure timeline, and scope for security issues in the project.

Workflow Automation and Quality Checks:

• Introduced a new GitHub Actions workflow for dependency review to automatically check for dependency-related issues on pull requests (.github/workflows/dependency-review.yaml).
• Added a Scorecard supply-chain security workflow to regularly assess repository security best practices and upload results to GitHub's code scanning dashboard (.github/workflows/scorecard.yml).
• Implemented a typing check workflow using ty and uv to ensure type safety in the codebase on every push and pull request (.github/workflows/typing.yaml).

Editor Configuration:

• Updated .editorconfig to enforce 2-space indentation for YAML files and fixed a typo in the indent_style property for Makefiles.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.89%. Comparing base (9440651) to head (2a43282).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1442   +/-   ##
=======================================
  Coverage   99.89%   99.89%           
=======================================
  Files           6        6           
  Lines         955      955           
  Branches      128      128           
=======================================
  Hits          954      954           
  Partials        1        1           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Adds security-focused project policy and CI automation to improve vulnerability management and code quality signals.

Changes:

• Introduces new GitHub Actions workflows for dependency review, Scorecard supply-chain checks, and ty-based typing validation.
• Adds a SECURITY.md policy document describing reporting and disclosure expectations.
• Standardizes YAML indentation in .editorconfig and fixes a Makefile indent_style typo.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/typing.yaml	Adds a CI job to run uv run ty check on src and tests.
.github/workflows/scorecard.yml	Adds a scheduled/push Scorecard analysis that uploads SARIF to code scanning.
.github/workflows/dependency-review.yaml	Adds dependency review checks on pull requests.
.github/SECURITY.md	Documents supported versions and private vulnerability reporting/disclosure process.
.editorconfig	Enforces 2-space YAML indentation and fixes Makefile indentation config typo.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud