ci: add security review and audit checks

[benvinegar]

Summary

• add a dedicated Security workflow with dependency review on PRs and an allowlisted Bun audit job on PRs and main
• make CI and release workflows explicitly default to read-only contents permissions
• document the new audit command and add tests for the audit parser/allowlist behavior

Testing

• bun run typecheck
• bun test
• bun run check:pack
• bun run check:security-audit

[benvinegar]

Closing for backlog cleanup. This security workflow/audit work is now too far behind current main to merge cleanly. If we still want it, it should be reopened as a fresh PR rebased onto the current CI layout.