chore: harden repository security automation

[cmilesio]

What

Apply the same security boundary to the root, documentation, and example Str modules.

Control	Coverage
organization-managed CodeQL	Default setup scans all Go source without a duplicate repository workflow
govulncheck	Every module dependency graph
Gitleaks	Full repository history
CycloneDX	Three canonical JSON library SBOMs with test dependencies
Dependabot	Every module and GitHub Actions

Local replacements use equivalent ./.. syntax so machine-readable component identity stays canonical. No string API, output behavior, minimum Go version, configuration, or stored-data change.

Dependency Review is active on pull requests through the organization dependency graph configuration.

Why

The root package is only part of the published repository surface. Dynamic discovery ensures docs and examples receive the same dependency, source, inventory, and update coverage without maintaining parallel lists.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.