chore: add rubocop and brakeman to CI

[vinimachadosantana]

What

Wires RuboCop and Brakeman into CI as separate parallel jobs.

Why

Style and security checks belong in the pipeline before feature code exists, so every later PR is held to the same bar rather than having it retrofitted.

How

• Both gems already ship with Rails 8, this only adds the CI jobs.
• Separate jobs rather than extra steps, so they run in parallel with the specs and a lint failure doesn't hide a failing test.
• Brakeman as a Rails-specific static analyser.

Testing

• bundle exec rubocop clean
• bundle exec brakeman clean
• CI green with all three jobs