Add free security scanning CI (CodeQL + pip-audit + Dependabot)

[ivan-pinatti]

Summary

The repository currently has no security scanning or CI/CD workflows. This means:

• Python logic bugs and unsafe API usage go undetected (no SAST)
• Vulnerable dependency versions aren't flagged (no SCA)
• Dependency updates require manual tracking

Proposal

Add free, automated security scanning at two levels:

CI (GitHub Actions)

1. CodeQL (GitHub's own SAST) — finds Python logic bugs, injection flaws, unsafe API usage. Results appear in the Security > Code scanning tab.
2. pip-audit — scans installed dependencies against the OSV database for known CVEs. The full project (including PyGObject) is installed in a clean Ubuntu runner with system libs, so all dependencies including transitive ones are covered.
3. Dependabot — automatically opens PRs when dependencies have security updates, and keeps GitHub Actions action versions current.

Local (pre-commit)

4. bandit — runs SAST on staged Python files before each commit, giving immediate local feedback without waiting for CI.
5. pip-audit — scans direct dependencies from requirements.txt (which mirrors install_requires in setup.py) against the OSV database before each commit.
   • PyGObject is excluded from requirements.txt because it requires gobject-introspection system headers to build metadata, which are not universally available. It is fully covered by pip-audit in CI.
   • Transitive dependency CVEs are covered by pip-audit in CI.

Implementation

• .github/workflows/security.yml — CodeQL + pip-audit jobs triggered on push, PR, weekly schedule, and manual dispatch
• .github/dependabot.yml — weekly checks for pip and GitHub Actions ecosystems
• .pre-commit-config.yaml — bandit SAST + pip-audit hooks running on staged files / before commit
• requirements.txt — direct dependencies for local pip-audit (mirrors setup.py install_requires)

No external accounts, tokens, or paid services required.

I'd like to submit a PR implementing this if you're open to it.