Add dependency auditing/monitoring

[drewbo]

We'd like to ensure that we don't merge vulnerable dependencies into this repo.

Notes

• Configure dependabot behavior pages-core#4217
• https://github.com/pypa/pip-audit
• Add dependency auditing to pipelines #460
• https://github.com/cloud-gov/internal-docs/blob/main/docs/runbooks/Pages/dependabot-security.md
• Enable Dependabot security scanning #464

Acceptance Criteria

• Add dependency auditing to the CI pipeline
• Enable dependabot security scanning via Github Security configuration
• Update internal docs/runbook to indicate that our quarterly process should apply to this repo as well

[svenaas]

Dependency auditing added with #460

[svenaas]

@drewbo It looks like Dependabot security scanning is already enabled. Or did you intend a change in our rules?

[drewbo]

Ideally I'd like to configure it like https://github.com/cloud-gov/pages-core/pull/4222/files#diff-dd4fbda47e51f1e35defb9275a9cd9c212ecde0b870cba89ddaaae65c5f3cd28. The intent is to not open PRs for version updates (seemingly working) and to preface other PRs with [ci skip] (not working)

[drewbo]

Also let's update the runbook/internal doc to indicate that our quarterly process should apply to this repo as well.

[svenaas]

Ideally I'd like to configure it like https://github.com/cloud-gov/pages-core/pull/4222/files#diff-dd4fbda47e51f1e35defb9275a9cd9c212ecde0b870cba89ddaaae65c5f3cd28. The intent is to not open PRs for version updates (seemingly working) and to preface other PRs with [ci skip] (not working)

Should it have a schedule (interval: weekly) like current pages-core?