OSV / security scanning workflow

[ulises-jeremias]

Summary

Scheduled vulnerability scanning for Python deps.

CNA mapping

CNA: osv-scanner.yml (OSV dedicated; MegaLinter disables duplicate OSV).

Acceptance criteria

• Scheduled + workflow_dispatch
• security-events: write if uploading SARIF
• Documented in SECURITY.md

Blocked by

none

Blocks

none

Reference

Parity matrix (workspace): knowledge/create-python-app-parity-matrix.md
Reference repo: https://github.com/Create-Node-App/create-node-app

Parent epic

#7