Add dependency auditing to pipelines

[svenaas]

Part of #458

Changes proposed in this pull request:

• Add pip-audit as a dev dependency.
• Add pip-audit.sh script and new audit-dependencies tasks which run it in the CI pipelines.

security considerations

None. This introduces a new check to help ensure that out-of-date dependencies get resolved.

[apburnes]

Great start! Can you add the audit task to the staging and prod pipelines?

[drewbo]

For the audit you can install just pip-audit to speed this up a bit

[svenaas]

Done. Still works and it's definitely lighter.

[svenaas]

Great start! Can you add the audit task to the staging and prod pipelines?

I've added it to pipeline.yml now; I'm not sure whether it would be wise to adjust any of its details there.

[drewbo]

@svenaas for staging/prod (which both run off pipeline.yml) I would set the audit to run off the git resource rather than the pr resource (src-((deploy-env))). Right now we have a little duplication in triggers here. Eventually we can match the pages-core pattern but that will take a bit of work

[svenaas]

@svenaas for staging/prod (which both run off pipeline.yml) I would set the audit to run off the git resource rather than the pr resource (src-((deploy-env))). Right now we have a little duplication in triggers here. Eventually we can match the pages-core pattern but that will take a bit of work

@drewbo How's this latest commit look? I changed the notification text a little as well.