v0.4.1 Security hardening

Security hardening pass over the Checkov and Codacy findings.

• The Docker image now runs as a non-root cloudg user and carries a HEALTHCHECK.
• install.sh no longer pipes curl output straight into bash; installer scripts are downloaded to a temp file first (Homebrew, NodeSource, Azure CLI).
• Third-party GitHub Actions are pinned to full commit SHAs across all workflows.
• Plugin loading validates the module:Class path shape before importlib.import_module.
• Retry jitter uses the system RNG.
• Silent except: pass handlers now log at debug level, so swallowed errors are traceable.
• Log messages no longer put words like "credentials" next to runtime values.
• The vulnerability-report email moved out of SECURITY.md in favour of GitHub private reporting.
• A .codacy.yml scopes analysis to shipped code and documents suppressed false positives (pytest asserts, taxonomy names such as AssetType.SECRET).

What's Changed

• Version releases from the git tag and show the docs on PyPI by @morpheuslord in #7
• Copy the package readme into the Docker build context by @morpheuslord in #8
• Security hardening: resolve Checkov and Codacy findings (0.4.1) by @morpheuslord in #10

Full Changelog: v0.4.0...v0.4.1