[MEDIUM] No security scanning in CI (SAST/dependency/container)

[ibuyspy]

No matches for \codeql, \dependency-review, \ rivy, \ fsec, \checkov, or
pm audit\ in any workflow.

Fix: Add security scan stage(s): dependency audit + CodeQL + container scan + IaC scan.
Source: DevOps audit