feat(lint): add CWE-tagged security rules

[ofri-peretz]

What this adds

A security block in eslint.config.mjs — 48 rules from eslint-plugin-node-security and eslint-plugin-secure-coding, covering command injection, path traversal, unsafe deserialization and the crypto misuse patterns that apply to a Node library.

It finds nothing here, and that is the point

I ran these rules against this repository before opening the PR: 0 findings across 4.5 KLOC. eslint exits 0 and all 106 tests pass, unchanged. The diff adds no work.

The ask is to keep it that way. A rule that is not enabled catches nothing on the day someone builds a shell command out of a template literal.

To show the rules are live rather than silently configured, a deliberate violation reports:

2:36  error  🔒 CWE-78 OWASP:A05-Injection CVSS:9.8 | Shell command built via string
             concatenation or template literal. An attacker who controls any interpolated
             value can execute arbitrary OS commands. | CRITICAL [SOC2,PCI-DSS,ISO27001]
             Fix: Use spawn(cmd, [arg1, arg2]) with separate arguments instead of
             exec(cmd + args).   node-security/no-shell-injection

That one is worth having in a dashboard generator specifically: this library takes names and queries from callers and renders them into JSON, and the boundary between "template a dashboard" and "template a command" is the kind of thing a linter should be watching.

Every message carries a CWE identifier and a CVSS score rather than just a rule name, which is the form an audit asks for.

Notes

• Both packages are devDependencies; nothing is added to what consumers install.
• Pinned to ^5.2.1 and ^5.1.2.
• Happy to narrow the rule set, drop it to warn, or scope it to src/ if you would rather adopt gradually.

[CLAassistant]

All committers have signed the CLA.