feat: add vulnerability audit workflow (PoC)

[albertotb]

Summary

• Adds a GitHub Actions workflow that audits dependencies for known vulnerabilities
• Includes three approaches for comparison:
  1. pip-audit (PyPA official) — exports uv.lock to requirements format and pipes it into pip-audit (no install needed)
  2. uv-secure — reads uv.lock directly, no install needed
  3. uv audit — native uv command (preview), reads uv.lock directly using the OSV database
• Runs weekly on Mondays, on workflow_dispatch, and on PRs that change uv.lock or pyproject.toml

Test results

All three tools ran successfully and detected the same vulnerability:

• pygments 2.19.2 — CVE-2026-4539 (ReDoS)

	pip-audit	uv-secure	uv audit
Runtime	~16s	~5s	~2s
uv.lock support	Indirect (export step)	Native	Native
Maintainer	PyPA (official)	Community	Astral (uv)
Notes	Well-established	Fast, supports severity filtering	Requires --preview flag, may change before stable

Next steps

• Decide which tool to keep (recommendation: uv-secure for simplicity)
• Add to python-copier-template and roll out to all repos
• Consider continue-on-error: true for scheduled runs to avoid noisy failures