Configure AppSec in CI

[smlx]

Partially addresses #3771 by enabling various GitHub features and workflows — see that issue for details.

To inspect SBOMs attached to images you can use:

$ docker buildx imagetools inspect testlagoon/api:pr-4054 --format "{{ json .SBOM }}" | head
{
  "linux/amd64": {
    "SPDX": {
      "SPDXID": "SPDXRef-DOCUMENT",
      "creationInfo": {
        "created": "2026-02-03T07:23:50Z",
        "creators": [
          "Organization: Anchore, Inc",
          "Tool: syft-v1.40.0",
          "Tool: buildkit-v0.27.1"

SBOM scanning during image build also doesn't seem to add much to image build time. Here's this PR jenkins build time (top) vs the most recent successful run on main (bottom):

The rest of #3771 can be addressed once this is merged.