v1.4.1 - Security Improvements

Security Enhancements

• Add SECURITY.md with vulnerability reporting policy
• Add Dependabot configuration for automated dependency updates (pip, Docker, GitHub Actions)
• Add CodeQL workflow for static analysis (SAST)
• Pin all Docker base images by SHA256 digest
• Enable branch protection on main branch

Dependencies

• Bump actions/checkout from v4 to v6
• Bump github/codeql-action from v3 to v4

OpenSSF Scorecard Improvements

Check	Before	After
Security-Policy	0	10
Dependency-Update-Tool	0	10
SAST	0	10
Pinned-Dependencies	6	10
Branch-Protection	0	~8

Expected overall score: ~7.5-8.0 (up from 5.1)