ci: add non-blocking PySentry dependency audit

[nyudenkov]

Description

Adds .github/workflows/pysentry.yml — a non-blocking dependency vulnerability audit using PySentry. It parses uv.lock natively (no resolver, no dev-dependency added to pyproject.toml), uploads results as SARIF to the Security tab, and cross-checks three advisory databases (PyPA, PyPI, OSV). The job is continue-on-error: true, so it's advisory and never blocks a PR. The action and checkout are pinned by SHA to match your pinned-dependencies setup.

Related Issue

Follow-up to #1029 (pip-audit doesn't flag uv.lock dependencies).

Motivation and Context

#1029 found that pip-audit alone doesn't read uv.lock, so lockfile dependencies went unaudited. PySentry reads uv.lock directly, which covers that gap without changing project dependencies. Added as a separate, non-blocking job so it surfaces findings in the Security tab without gating CI.

How Has This Been Tested?

YAML validated locally. The workflow uses PySentry's official pinned GitHub Action; SARIF upload targets Code Scanning, which is already enabled here via CodeQL. Full behavior is visible on the first run of this PR (Actions run summary + Security tab).

Screenshots (if appropriate):

N/A

Types of changes

• New feature (non-breaking change which adds functionality)

AI Usage Disclosure

• ⭐ AI-assisted. Car analogy : you drive the car, AI help you find your way.

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the docs/how-to/contributing.md document.
• I have added tests to cover my changes.
• All new and existing tests passed.

[nyudenkov]

@inimaz I also can add scan to the pre-commit if u want it :)