Add dependency security checks in CI

[micahellison]

I was just reading this excellent report on the recent malicious takeover of the ctx project and it has me thinking that we might benefit from some automated security checks in our GitHub Actions. The report specifically mentions Safety and pip-audit. Both of them look like they would play well within GH Actions.

[micahellison]

Looks like GitHub's code scanning is worth looking into also.