fix(deps): raise requests/sentry-sdk floors past CVEs, add Trivy scan, drop unused doc

[leoparente]

Summary

Three related maintenance changes in one PR:

1. Raise dependency floors past known CVEs (security-focused; installs already resolve above these, so no behavior change — this only prevents a constrained resolve from reaching a vulnerable version).
2. Add a Trivy dependency + secret scan, mirroring the coverage orb-agent has (CodeQL is already active here via default setup; Trivy was the gap).
3. Remove docs/entities.md, an unused stub.

1. Dependency floors

Determined empirically by scanning the declared floor versions with Trivy:

Package	Was	Now	Advisories at the old floor
requests	>=2.31.0	>=2.33.0	CVE-2024-35195, CVE-2024-47081, CVE-2026-25645
sentry-sdk	>=2.2.1	>=2.8.0	CVE-2024-40647

certifi, grpcio, grpcio-status, and opentelemetry-proto floors were scanned too and are already clean, so they're left as-is (keeping compatibility floors low is good library hygiene). A fresh pip install already pulls versions well above both new floors.

2. Trivy dependency scan

New .github/workflows/security.yaml. Because pyproject.toml uses open >= ranges (which Trivy can't evaluate — a plain trivy fs on the repo finds nothing), the job first pip installs the package and pip freezes concrete versions into a requirements.txt (not committed), then runs trivy fs over the tree (scanners: vuln,secret, all severities, ignore-unfixed) and uploads SARIF to code-scanning. Same pinned action versions and settings as orb-agent; non-blocking; runs on push, PRs, a daily schedule, and manual dispatch.

3. Doc removal

docs/entities.md was a two-line stub that only redirected to the README, with no references anywhere in the repo.

Verification

• Test suite: 213 passed on the updated floors (Python 3.11 venv).
• Workflow: actionlint clean; validated locally that the pip-freeze → trivy fs flow detects concrete-version advisories (and that the current resolved tree scans clean).

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

Coverage Report

File	Stmts	Miss	Cover	Missing
/opt/hostedtoolcache/Python/3.10.20/x64/lib/python3.10/site-packages/netboxlabs/diode/sdk
chunking.py	33	1	97%	112
client.py	567	42	93%	202–203, 222–224, 227–230, 522, 590, 595, 599, 682–687, 732–734, 764, 768, 772, 794, 815, 817, 891, 922, 930, 992–993, 1002, 1035, 1062, 1067–1068, 1097, 1102–1105
exceptions.py	44	3	93%	69, 82–83
TOTAL	659	46	93%

Tests	Skipped	Failures	Errors	Time
213	0 💤	0 ❌	0 🔥	2.045s ⏱️

[github-actions]

🎉 This PR is included in version 1.13.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀