Add Snyk Elixir security scan workflow

[mikhailbahdashych-glia]

Why

This repository is categorised production_library in DevHub, which requires Snyk coverage. Elixir has no Snyk SCM support — importing through the GitHub Cloud App produces no projects — so the CLI workflow is the only path that scans mix.lock (hex dependencies).

Docs: Snyk for Elixir projects

What this does

• pull_request / merge_group: tests the dependency tree the change would introduce
• push to master: (re-)registers the repo's hex projects in Snyk org glia-sudo (via the SNYK_ORGANIZATION_SLUG Actions variable, already set on this repository)
• weekly schedule + workflow_dispatch: keeps the snapshot fresh when the repository is quiet

Merging this PR is what creates the Snyk projects — the push run performs the snyk monitor registration.

🤖 Generated with Claude Code

[mikhailbahdashych-glia]

⚠️ Converted to draft — do not merge yet. This repository is public, and the workflow as written cannot run here for two reasons: (1) public repos cannot call the private salemove/glia-security-workflows reusable workflow, and (2) the org-level SNYK_TOKEN secret is not shared with public repositories. A revised, self-contained version will follow once the approach is agreed. (Found by post-creation audit.)

[mikhailbahdashych-glia]

✅ Reworked per the security team's decision: the workflow is now self-contained — the scan steps from the shared glia-security-workflows reusable workflow are inlined directly, since a public repository cannot call a private reusable workflow. Triggers follow the security docs (weekly schedule + manual dispatch).

Remaining blocker before un-drafting: a SNYK_TOKEN secret available to this public repository — none is visible yet. The snyk monitor step is additionally gated on the SNYK_ORGANIZATION_SLUG Actions variable (already set), so merging can never register into a wrong Snyk org.