ci: add security scanning

[okwn]

Summary

Adds security scanning to CI.

Testing

CI passes.

---

Summary by cubic

Adds a security job to CI that runs pnpm audit --audit-level=high and blocks releases on high-severity findings. This helps catch vulnerable dependencies before publishing.

• New Features
  • Added security job using actions/checkout@v6, actions/setup-node@v6, and pnpm/action-setup@v4; installs with --frozen-lockfile and runs pnpm audit --audit-level=high.
  • Updated dependencies between jobs: test now needs compile; publish now needs compile, test, and security.

^{Written for commit bc8f80b. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}