Enable Dependabot alerts and secret scanning

[kgdunn]

Migrated from TODO.md (CI / release / infra section). Repository settings task.

Items covered

• Settings -> Code security -> enable Dependabot alerts and Dependabot security updates. (Add CodeQL workflow and extend Dependabot to pip #97)
• Settings -> Code security -> confirm secret scanning is enabled. (Add CodeQL workflow and extend Dependabot to pip #97)

[kgdunn]

Triaged during the issue-triage pass (#234).

This is a repository-settings task and cannot be done from a code PR. To resolve it: in Settings -> Code security, enable Dependabot alerts and Dependabot security updates, and confirm Secret scanning (and push protection) is on. Once enabled this issue can be closed.

---

Generated by Claude Code