ci(security): add informational security checks

[alangou]

Summary

Add observation-mode security checks for GitHub Actions, dependency changes, and the Rust/SDK codebase. Findings remain informational while scanner, configuration, and build failures stay visible.

Related Issue

Refs #2837

This PR implements the initial scanner-observation tranche and does not close the broader repository-hardening issue.

Changes

• add pinned Actionlint and Zizmor tooling with High-severity workflow reports and retained artifacts
• add Dependency Review in warn-only mode with a neutral Dependency Graph availability preflight
• add non-blocking CodeQL analysis for Rust and the Go, Python, and TypeScript SDKs
• document the GitHub-hosted security checks and their non-required status

Testing

• mise run pre-commit passes
• Unit tests added/updated — N/A; mise run ci passes the existing suite
• E2E tests added/updated — N/A; no runtime or deployment behavior changed
• mise run security:actionlint
• mise run security:zizmor

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2930.docs.buildwithfern.com/openshell

[alangou]

/ok to test 1a6053e

[alangou]

/ok to test 228bf5a

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.