feat: improve project security posture

[trumant]

This PR introduces the following security changes to the project

• Dependabot configuration for daily scans/updates from the Python and GitHub Actions ecosystems
• Updates to the project CI GHA workflow to improve security
  • Upgrade reusable actions to latest release versions
  • Use poetry in CI to ensure consistent dependency version usage between dev and CI
  • Add execution of bandit and gitleaks checks
• pre-commit tooling for contributors now runs bandit, snyk, zizmor and gitleaks
  • CI, codebase and dependency changes made to reflect issues found in scans
• security-insights.yml added to communicate security changes to project made above

Here is the pre-commit output from this commit:

ruff.....................................................................Passed
ruff-format..............................................................Passed
bandit...................................................................Passed
Detect hardcoded secrets.................................................Passed
Snyk Test................................................................Passed
- hook id: snyk-test
- duration: 3.61s

[pre-commit-snyk] 2025-07-22 09:00:50 level=info Snyk path: /opt/homebrew/bin/snyk
[pre-commit-snyk] 2025-07-22 09:00:50 level=info Snyk version: 1.1298.0
[pre-commit-snyk] 2025-07-22 09:00:50 level=info Snyk arguments: test --file=poetry.lock --package-manager=pip --fail-on=upgradable

Testing /Users/travistruman/dev/uqlm...

Tested 103 dependencies for known issues, found 8 issues, 24 vulnerable paths.

Issues with no direct upgrade or patch:
  ✗ Improper Resource Shutdown or Release [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-10332643] in torch@2.7.1
    introduced by torch@2.7.1 and 2 other path(s)
  No upgrade or patch available
  ✗ Buffer Overflow [High Severity][https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-10332644] in torch@2.7.1
    introduced by torch@2.7.1 and 2 other path(s)
  No upgrade or patch available
  ✗ Buffer Overflow [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-10332645] in torch@2.7.1
    introduced by torch@2.7.1 and 2 other path(s)
  No upgrade or patch available
  ✗ Mismatched Memory Management Routines [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-10337825] in torch@2.7.1
    introduced by torch@2.7.1 and 2 other path(s)
  No upgrade or patch available
  ✗ Out-of-bounds Write [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-10337826] in torch@2.7.1
    introduced by torch@2.7.1 and 2 other path(s)
  No upgrade or patch available
  ✗ Out-of-bounds Write [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-10337828] in torch@2.7.1
    introduced by torch@2.7.1 and 2 other path(s)
  No upgrade or patch available
  ✗ Out-of-bounds Write [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-10337834] in torch@2.7.1
    introduced by torch@2.7.1 and 2 other path(s)
  No upgrade or patch available
  ✗ Improper Check for Unusual or Exceptional Conditions [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-9726944] in torch@2.7.1
    introduced by torch@2.7.1 and 2 other path(s)
  No upgrade or patch available

Organization:      trumant
Package manager:   poetry
Target file:       pyproject.toml
Project name:      uqlm
Open source:       no
Project path:      /Users/travistruman/dev/uqlm
Licenses:          enabled

[pre-commit-snyk] 2025-07-22 09:00:52 level=info Snyk exit code: 0

zizmor...................................................................Passed