ci: add non-blocking PySentry dependency audit

[nyudenkov]

Description

Adds .github/workflows/pysentry.yml — a non-blocking dependency vulnerability audit using PySentry. It parses uv.lock natively (no resolver, no dev-dependency added to pyproject.toml), uploads results as SARIF to the Security tab, and cross-checks three advisory databases (PyPA, PyPI, OSV). The job is continue-on-error: true, so it's advisory and never blocks a PR. The action and checkout are pinned by SHA to match your pinned-dependencies setup.

Related Issue

Follow-up to #1029 (pip-audit doesn't flag uv.lock dependencies).

Motivation and Context

#1029 found that pip-audit alone doesn't read uv.lock, so lockfile dependencies went unaudited. PySentry reads uv.lock directly, which covers that gap without changing project dependencies. Added as a separate, non-blocking job so it surfaces findings in the Security tab without gating CI.

How Has This Been Tested?

YAML validated locally. The workflow uses PySentry's official pinned GitHub Action; SARIF upload targets Code Scanning, which is already enabled here via CodeQL. Full behavior is visible on the first run of this PR (Actions run summary + Security tab).

Screenshots (if appropriate):

N/A

Types of changes

• New feature (non-breaking change which adds functionality)

AI Usage Disclosure

• ⭐ AI-assisted. Car analogy : you drive the car, AI help you find your way.

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the docs/how-to/contributing.md document.
• I have added tests to cover my changes.
• All new and existing tests passed.

[nyudenkov]

@inimaz I also can add scan to the pre-commit if u want it :)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.