chore: harden OpenSSF Scorecard from 4.3 to ~7.0 (#142)

Token-Permissions (0 -> 10): Set permissions: {} at workflow top level
across all 7 workflows, moved write scopes to per-job minimum.

SAST (0 -> 10): Added CodeQL workflow for JavaScript/TypeScript and
Python analysis on push, PR, and weekly schedule.

Vulnerabilities (0 -> ~8): Added 13 pnpm overrides to patch transitive
dependency vulnerabilities (38 -> 2 remaining, both in dev-only tools).

Pinned-Dependencies (5 -> 8-9): Pinned all Docker FROM images to SHA
digests, pinned pip-audit version in CI, pinned pip version in
Dockerfile.

package.json

@@ -79,7 +79,19 @@
   "license": "AGPL-3.0",
   "pnpm": {
     "overrides": {
-      "fast-uri": ">=3.1.2"
+      "fast-uri": ">=3.1.2",
+      "handlebars": ">=4.7.9",
+      "picomatch": ">=4.0.4",
+      "lodash": ">=4.18.0",
+      "lodash-es": ">=4.18.0",
+      "brace-expansion": ">=5.0.5",
+      "phin": ">=3.7.1",
+      "follow-redirects": ">=1.16.0",
+      "protobufjs": ">=7.5.6",
+      "@protobufjs/utf8": ">=1.1.1",
+      "postcss": ">=8.5.10",
+      "vite": ">=6.4.2",
+      "@fastify/static": ">=9.1.3"
     }
   },
   "dependencies": {