feat: add security-checks composite action

[andretetherio]

Summary

Adds the reusable security-checks composite action — implementation of tetherto/tips#7 (TIP-0001).

Single composite that consumer repos invoke from their PR CI to run a coupled security gate:

1. actions/dependency-review-action@v5.0.0 on the PR diff (SHA-pinned).
2. package-lock.json drift check (npm install --package-lock-only --ignore-scripts --no-audit --no-fund — no node_modules, no postinstall).
3. npm audit signatures — informational warning.
4. npm audit --audit-level=moderate — informational warning.
5. audit-ci high/critical gate on the full lockfile — opt-in via .github/audit-ci.jsonc; skipped if missing.

Security model

• Runs on pull_request only (not pull_request_target). Fork PRs get a read-only GITHUB_TOKEN, no secrets, no PR-code execution.
• dependency-review-action and npm audit are pure registry/API lookups — no PR code runs.
• Lockfile check uses --ignore-scripts so the root package's postinstall is not executed.
• audit-ci allowlist lives in the consumer repo (.github/audit-ci.jsonc) — not centralised, so per-repo false positives don't block shared infra.

Inputs

Each step has a skip-<name> toggle; fail-on-severity, npm-audit-level, audit-ci-config, summary-title, and scope-label are configurable. Full docs in security-checks/README.md.

What this does NOT change

• No new vendor / scanner — dependency-review-action and npm audit both resolve against the GitHub Advisory Database (same data that powers Dependabot alerts).
• No new services or secrets required.
• Consumer build/test workflows are untouched.

Test plan

• Reference implementation in `tetherto/mdk-docs#76` calls the composite end-to-end.
• Verify summary renders under `$GITHUB_STEP_SUMMARY` for: signatures-fail, moderate-fail, high/critical-fail, and clean cases.
• Verify behaviour when `.github/audit-ci.jsonc` is absent (warning notice, gate skipped).
• Confirm `$GITHUB_TOKEN` is read-only on a fork PR and dep-review still runs.
• Tag `v1.0.0` after merge so consumers can SHA-pin against a stable release.