docs: add dependency management and vulnerability reporting sections

What does this MR do?

Adds two subsections to CONTRIBUTING.md and a new Security section to README.md documenting:

• How Renovate manages direct Go and Node.js dependencies, with a link to the currently open dependency MRs.
• That every CI pipeline already runs GitLab Advanced SAST, Dependency Scanning, and Secret Detection, and that reachable Go vulnerabilities surface in the project's Vulnerability Report.
• How to report a security vulnerability responsibly via SECURITY.md instead of a public issue.
• How to use govulncheck to triage container-image scanner output (Trivy, Grype, and similar), which frequently flags module-level CVEs in transitive Go dependencies (sub-packages of x/image, x/net, etc.) that the CLI does not import.

Why is this MR needed?

Several community reports (most recently #8397 (closed), previously !3229 (closed)) have been container-scanner CVE dumps for transitive Go dependencies that are not reachable from glab code. Having a documented place to point reporters — covering how updates are managed, what scanning already runs in CI, and how to verify reachability with govulncheck — turns these into a link-and-close instead of re-explaining each time. It also steers anyone with a genuinely reachable finding to the responsible disclosure process in SECURITY.md.

Related to #8397 (closed).