Enable GitHub security features (secret scanning, Dependabot alerts, push protection)

## Recommendation

### 🔒 CRITICAL: Enable GitHub Security Features

All GitHub security features are currently disabled on this public repo:

```json
{
"dependabot_security_updates": "disabled",
"secret_scanning": "disabled",
"secret_scanning_push_protection": "disabled",
"secret_scanning_non_provider_patterns": "disabled",
"secret_scanning_validity_checks": "disabled"
}
```

## What Was Found

This is a public repo with thousands of users. Any accidentally committed secret would go undetected without secret scanning. Known vulnerable dependencies won't generate alerts without Dependabot alerts enabled.

## How to Fix

Go to **Settings → Code security and analysis** and enable:
- [x] Dependabot alerts
- [x] Dependabot security updates
- [x] Secret scanning
- [x] Push protection

## Impact

- **Zero code changes required** — this is a repo settings change
- Immediately surfaces any existing secrets or vulnerable dependencies

---
**Category:** Security | **Priority:** Critical | **Effort:** Trivial (~5 min)
Part of #11022
_Filed by repo-audit skill_

┆Issue is synchronized with this [Notion page](https://www.notion.so/Issue-11023-Enable-GitHub-security-features-secret-scanning-Dependabot-alerts-push-protection-33e6d73d3650815cb0c2ffb528670d88) by [Unito](https://www.unito.io)

Open the repository's Settings → Code security and analysis page and check the listed Dependabot and secret-scanning options. Enable Dependabot alerts, security updates, secret scanning, push protection, non-provider patterns, and validity checks as available. Done means the requested features show as enabled and the repository reports no remaining disabled settings.

Written by the indexing model from the issue text.