Add Grype vulnerability scanner workflow

[Copilot]

Adds a GitHub Actions workflow that scans dependencies for known vulnerabilities using Grype and uploads results as SARIF to GitHub Code Scanning.

• New workflow (.github/workflows/vulnerability-scan.yaml): Runs on push/PR to master. Grype parses lockfiles directly via Syft's javascript-lock-cataloger—no npm ci or node_modules needed.
• Fails the build on high or critical severity findings
• Uploads SARIF report unconditionally for visibility in the Security tab

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Add vulnerbility scanner</issue_title>
<issue_description>Add a free tier vulnerability scanner that will fail on high/crit.
do not use trivy</issue_description>

<agent_instructions>check online what the best free vuln scanner is </agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes Add vulnerbility scanner #289

---

⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.