[CI]: Add CodeQL SAST, Dependabot config, and OSSF Scorecard workflow

[spencrr]

Description

Add CodeQL SAST analysis, Dependabot dependency management, and OSSF Scorecard
supply-chain security workflow.

CodeQL (.github/workflows/codeql.yml):

• Runs on push to main, PRs targeting main, and weekly (Wednesdays 14:25 UTC)
• Python language analysis with pinned action SHAs (actions/checkout@v6.0.2,
  github/codeql-action@v4.35.1)
• Minimal permissions scoped to actions: read, contents: read, security-events: write

Dependabot (.github/dependabot.yml):

• Weekly update checks for uv, GitHub Actions, pre-commit, Docker, docker-compose,
  and devcontainers ecosystems
• Commit messages prefixed with [MAINT] per repo convention
• Minor/patch updates grouped for uv to reduce PR noise

OSSF Scorecard (.github/workflows/scorecard.yml):

• Runs on push to main, PRs, and weekly (Saturdays 06:30 UTC)
• Uploads SARIF results to GitHub code scanning dashboard
• Pinned to ossf/scorecard-action@v2.4.3

All workflows use persist-credentials: false and empty default permissions: {}
following security best practices.

Breaking changes

None

Checklist

• pre-commit run --all-files passes
• Tests added or updated for changes
• Documentation updated

[nina-msft]

LGTM after comments are addressed :)