ci: add security review and audit checks

[benvinegar]

Summary

• add a dedicated Security workflow with dependency review on PRs and an allowlisted Bun audit job on PRs and main
• make CI and release workflows explicitly default to read-only contents permissions
• document the new audit command and add tests for the audit parser/allowlist behavior

Testing

• bun run typecheck
• bun test
• bun run check:pack
• bun run check:security-audit