feat(trivy): track CVEs with expiring ignores

Plan

1. Add opt-in security controls to the workflow and Trivy components, including the CI_WORKFLOW_SECURITY_ENABLED override.
2. Turn new fixed and unfixed CVEs into deduplicated type::security issues and per-CVE commits with expiring Trivy ignores on writable branches.
3. Add the default security label, regression tests, and usage documentation.

Acceptance criteria

• Security automation is disabled by default; CI_WORKFLOW_SECURITY_ENABLED=true|false overrides component inputs.
• New fixed and unfixed CVEs at the configured severity produce one tracking issue per CVE when GITLAB_TOKEN is available.
• A branch with token push permission gets an expiring .trivyignore.yaml entry and a ci.skip push per new CVE; existing entries are not renewed.
• Detached pipelines can still create issues without attempting a push; protected branches use the token’s actual push permission.
• Focused shell tests, YAML parsing, and generated-doc checks pass locally.
• MR pipeline succeeds and final diff is reviewed.

The referenced workflow-auto-ignore-enabled setting is not present on the default branch. This implementation uses the new workflow-security-enabled control and lets CI_WORKFLOW_SECURITY_ENABLED override it.

Closes #392 (closed).