Add workflow to post Dependabot alerts to Slack

[JamesBuzaid-at]

Adds a GitHub Actions workflow that posts Dependabot alerts to Slack.

• Triggers on the dependabot_alert event (created, reopened), so it fires in near real-time when GitHub opens an alert.
• Reads everything from the event payload (github.event.alert) — package, severity, manifest path, GHSA ID, summary, alert URL — so there's no GitHub API call and no PAT required.
• Posts a Block Kit message via a Slack incoming webhook using curl.

Setup required before it works:

• Add a SLACK_WEBHOOK_URL repo secret (Slack incoming webhook for the target channel).
• The workflow only runs once it's on main, since dependabot_alert triggers off the default branch's workflow files.

Test plan: None. There's no way to fire a real dependabot_alert event on demand; the field paths follow GitHub's documented payload and the YAML/jq validate locally.