Application security in CI

[smlx]

This issue tracks the rollout of application security in CI, including:

• Dependabot
• CodeQL
• secret scanning
• private vulnerability reporting
• dependency review
• OpenSSF scorecard and best practices
• release signing
• release SBOMs
• test coverage
• code linters