Enable Dependabot + secret scanning + CodeQL (repo settings)

[wimaan3]

Context

Turn on GitHub's native security features.

Acceptance criteria

• Dependabot alerts + security updates enabled.
• Secret scanning + push protection enabled.
• CodeQL default setup enabled (or via the CI-security workflow).

[wimaan3]

Dependabot config + alerts enabled (183a3df, PR #28). Secret scanning + CodeQL require a public repo or GitHub Advanced Security — deferred to publish time per docs/notes/PUBLISH-CHECKLIST.md §3–4.