Automated dependency

[gloskull]

Motivation

• Provide a centralized, reproducible dependency vulnerability scanning pipeline for Rust crates to block known vulnerable or yanked dependencies before code reaches main.
• Make local and CI scans share the same entrypoint so security policy changes can be reviewed in one place and evidence retained as machine-readable artifacts.
• Automate dependency updates via Dependabot so maintainers receive timely PRs for triage.

Description

• Add a reusable scan script scripts/dependency-vulnerability-scan.sh that runs cargo audit and cargo deny and writes JSON reports to target/security/.
• Add a GitHub Actions workflow .github/workflows/dependency-vulnerability-scan.yml to run scans on PRs, pushes to main, a nightly schedule, and manual dispatch, and to upload JSON artifacts.
• Add deny.toml to enforce advisory, license, yanked, duplicate-version, wildcard, and source policies for cargo-deny.
• Add Dependabot config .github/dependabot.yml and documentation docs/dependency-vulnerability-scanning.md plus runbook docs/runbooks/dependency-vulnerability-scanning.md describing architecture, operational targets, and incident handling.

Testing

• bash -n scripts/dependency-vulnerability-scan.sh (syntax check) passed.
• git diff --check was run and reported no issues for the new files.
• Executing scripts/dependency-vulnerability-scan.sh could not complete locally because cargo-audit was not installed in the environment (script exits with an advisory message when tools are missing).
• cargo test was run and returned 131 passed, 17 failed, where the failing tests are in pool_manager/tenant-bond and reentrancy-guard tests that are unrelated to the dependency-scanning additions.

Closes #81