feat(security): harden workflows, add triage SLAs, patch vulnerabilities

[DerekRoberts]

Remediates active dependency vulnerabilities in the backend, documents security triage SLAs, introduces vulnerability triage issue templates, removes Trivy container image scanning from the PR build workflows, and ensures security scans run in a non-blocking configuration.

---

Thanks for the PR!

Deployments, as required, will be available below:

• Frontend
• Backend

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

[Copilot]

Pull request overview

This PR strengthens the repository’s security posture by documenting vulnerability triage expectations, adding an issue template to standardize security remediation tracking, and updating backend locked dependencies as part of vulnerability remediation.

Changes:

• Documented vulnerability triage SLAs in SECURITY.md.
• Added a GitHub issue template for security vulnerability triage.
• Updated backend/package-lock.json (including bumps such as hono and qs).

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.

File	Description
SECURITY.md	Adds documented vulnerability triage SLAs for security issues.
backend/package-lock.json	Updates locked dependency graph to incorporate remediation-related dependency changes.
.github/ISSUE_TEMPLATE/security-triage.md	Introduces a standardized issue template for tracking vulnerability triage/remediation.

Files not reviewed (1)

• backend/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.