CertScope: update dependencies and deployment and CI (+2 areas)

Public changes compared with the previous published export:
4 files changed.

Affected areas:
- dependencies: 1 file
- deployment and CI: 1 file
- documentation: 1 file
- scripts: 1 file

Changed files:
- Added: ".gitea/workflows/ci.yml"
- Updated: "SECURITY.md"
- Updated: "package-lock.json"
- Added: "scripts/audit-dependencies.mjs"

Export provenance/manifests refreshed; excluded from the change summary.

Publish curated CertScope source from 9cd536d4e2dd485794e5f5accd70220de4a081de

.gitea/workflows/ci.yml

@@ -0,0 +1,40 @@
+name: Public source validation
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: CertScope-Public-validation
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    runs-on: linux-validation
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22
+          cache: npm
+      - name: Install locked dependencies
+        run: npm ci --no-audit --no-fund
+      - name: Audit production dependencies
+        run: npm audit --omit=dev --audit-level=high
+      - name: Audit full dependency graph
+        run: node scripts/audit-dependencies.mjs
+      - name: Lint
+        run: npm run lint
+      - name: Typecheck
+        run: npm run typecheck
+      - name: Unit tests
+        run: npm test
+      - name: Production build
+        run: npm run build