GitHub security workshop: Add dependency risk and remediation workflow

[softchris]

Goal

Teach learners to identify, prioritize, and remediate vulnerable dependencies using the dependency graph, Dependabot alerts, security updates, and pull-request checks.

Scope

Use a deterministic and isolated dependency fixture or a maintainer-selected advisory rather than permanently weakening the application dependencies. Cover direct versus transitive dependencies, advisory and severity information, compatibility review, update PRs, and post-merge verification.

Acceptance criteria

• Learners enable or verify the dependency graph, Dependabot alerts, and security updates.
• The lab produces a predictable dependency alert without leaving an intentionally vulnerable package on the default branch.
• Learners identify whether the package is direct or transitive and review the advisory, affected range, patched version, and severity.
• Learners review or create a remediation pull request and run the project tests against the update.
• The alert is verified as resolved after the safe version is merged.
• The exercise discusses grouped updates, compatibility risk, dismissals, and remediation ownership.
• Timing and no-fix-available scenarios have documented fallback data.
• The content coordinates with Add Python ecosystem to dependabot.yml #237 rather than duplicating its repository-wide Dependabot configuration work.