feat: add CodeQL SAST scanning and Dependabot dependency updates (clo…

[Padmapriya2121]

Summary

Fixes #833 — the repo had no automated security or dependency scanning. This adds:

1. CodeQL SAST scanning (.github/workflows/codeql.yml) — runs static security analysis on every push and PR to main, covering both JavaScript (frontend) and Python (backend/tracking_api.py). Also runs a scheduled full scan weekly.
2. Dependabot (.github/dependabot.yml) — automatically opens PRs for outdated/vulnerable dependencies weekly, covering both the Python backend (backend/requirements.txt) and the GitHub Actions themselves.

Why this matters

• Catches known vulnerability patterns (SQL injection, XSS, hardcoded secrets, etc.) automatically on every PR, before merge.
• Keeps dependencies patched without manual tracking.
• Directly reduces the risk called out in the issue: "the project might unknowingly merge code with known vulnerabilities or outdated, insecure dependencies."

Testing

GitHub Actions workflows can only be validated once pushed — see the Checks tab on this PR to confirm the CodeQL workflow runs successfully. Will update this PR if any config adjustments are needed based on the run.

[vercel]

@Padmapriya2121 is attempting to deploy a commit to the Shubhangi Roy's projects Team on Vercel.

A member of the Team first needs to authorize it.