ci: add bookmd security scanner (advisory)

[abir-vim]

Add bookmd security scanner (advisory)

This adds the self-contained org security scanner as .github/workflows/security.yml.

Advisory only — this does not block merges. On each PR it:

• runs OSV-Scanner on dependencies,
• runs a Claude (Bedrock) review across four phases (pr-review, architecture, taint, deps),
• posts a sticky Security Scanner Results comment with findings.

The in-job Security Gate ships disabled (BLOCK_ON_SEVERITY: none). To enforce later, set
BLOCK_ON_SEVERITY: critical in the workflow and add the AI security scan (phases 1-4) check to
this repo's branch protection.

Bedrock auth is via GitHub OIDC (no secrets). Optional org secrets: SCANNER_STATS_URL /
SCANNER_STATS_TOKEN (monitoring), SOCKET_API_TOKEN (Socket MCP).

🤖 Generated with Claude Code

[github-actions]

Security Scanner Results

This PR adds a single CI workflow file (.github/workflows/security.yml) and changes no application code or dependency manifests. No vulnerability is introduced or newly made reachable by this PR, so nothing here is BLOCK-worthy. Findings below are defense-in-depth notes on the workflow itself plus pre-existing dependency advisories from OSV.

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	2
🔵 Low	1
⚪ Info	3

Code findings

• 🟡 osv-scanner binary downloaded from latest over curl and executed unpinned — .github/workflows/security.yml:40
• 🟡 AI scan step granted broad Bash(gh api:*) alongside pull-requests/issues write — .github/workflows/security.yml:180
• 🔵 Third-party GitHub Actions pinned to mutable tags, not commit SHAs — .github/workflows/security.yml:168
• ⚪ Security gate is advisory only (BLOCK_ON_SEVERITY=none) — .github/workflows/security.yml:255
• ⚪ Workflow uses pull_request (not pull_request_target) — fork PRs get no secrets (positive) — .github/workflows/security.yml:10
• ⚪ No PR-controlled input flows to a shell/exec sink (taint clean) — .github/workflows/security.yml:327

Dependency findings (pre-existing; not changed by this PR)

• ⚠️ WARN xlsx@0.18.5 — GHSA-4r6h-8v6p-xvw6, GHSA-5pgg-2g8v-p4x9 (high; reachable via src/drive/handlers.ts, no fixed version available)
• ⚠️ WARN fast-xml-parser@5.3.4 — multiple advisories incl. critical (reachability unproven)
• ⚠️ WARN @modelcontextprotocol/sdk@1.25.3 — GHSA-345p-7cg4-v4c7 (high; direct dependency)
• ⚠️ WARN fastify@5.7.2 — 4 advisories (high; direct dependency)
• ℹ️ INFO hono@4.11.7, @hono/node-server@1.19.9, fast-uri@3.1.0, path-to-regexp@8.3.0, minimatch@3.1.2, ajv@8.17.1, qs@6.14.1, brace-expansion@1.1.12, yaml@1.10.2 — advisories present, reachability unproven from this codebase

Socket depscore was unavailable in this run (MCP server requires interactive OAuth, no token provisioned), so dependency reachability was judged directly from the codebase.