R2 CI: Add DevSecOps gates (gitleaks + dependency vuln checks + Trivy) + Dependabot

[Akash29g]

What / Why
This PR implements Round 2 (Akash — CI/CD “Lock the gate”) by adding DevSecOps checks so PRs are blocked if they introduce leaked secrets, vulnerable dependencies, or vulnerable container image layers.

Changes included

• Secret scanning: adds a gitleaks step in CI (scans PR working tree, not full git history).
• Dependency scanning:
  • .NET: dotnet list package --vulnerable --include-transitive and fail build if vulnerabilities are detected.
  • Node: npm audit --audit-level=high for the Angular app.
• Container image scanning: build API + web Docker images in CI and run Trivy with HIGH/CRITICAL severity gate.
• Dependabot: adds .github/dependabot.yml for weekly NuGet + npm update PRs.
• Repo hygiene: updates .gitignore to avoid committing local secrets/VS files and local scan artifacts.

Notes / Guardrails

• gitleaks is configured to avoid scanning git history (prevents permanent failures from already-rotated historical keys).
• Any CI failures after this are expected to be real findings (vuln deps or base image CVEs) and should be fixed via package/base-image bumps.

How to validate

• Open a PR → CI should run backend, frontend, and the new devsecops job.
• Local sanity: dotnet list ... --vulnerable and Docker builds already pass locally.

Round mapping

• Round 2 plan: DevSecOps scans in CI (dependency scanning + secret scanning + Trivy).