[codex] Add security automation baseline

[acodebeard]

Summary

• Adds Dependabot configuration for GitHub Actions updates.
• Adds CodeQL analysis for PHP on pushes, PRs, and a weekly schedule.
• Adds SECURITY.md pointing vulnerability reports to GitHub private vulnerability reporting.

Why

This supports the repository security settings work by adding the file-backed automation needed before requiring security checks on main.

Verification

• scripts/php-lint.sh
• scripts/check-source-only.sh
• scripts/check-file-modes.sh
• scripts/check-assets.sh
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 38c277c3ef

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Use a supported scanner instead of CodeQL PHP

For this PHP-only app, this workflow will fail at initialization rather than producing a required security signal: GitHub's CodeQL supported-language docs explicitly say unsupported languages include PHP, and github/codeql-action/init@v3 only accepts supported CodeQL language identifiers. If this check is made required on main as described by the commit message, every push/PR will be blocked until the workflow is removed or replaced with a PHP-capable scanner.

Useful? React with 👍 / 👎.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.