GitHub security workshop: Add dependency risk and remediation workflow

Goal

Teach learners to identify, prioritize, and remediate vulnerable dependencies using the dependency graph, Dependabot alerts, security updates, and pull-request checks.

Scope

Use a deterministic and isolated dependency fixture or a maintainer-selected advisory rather than permanently weakening the application dependencies. Cover direct versus transitive dependencies, advisory and severity information, compatibility review, update PRs, and post-merge verification.

Acceptance criteria

• Learners enable or verify the dependency graph, Dependabot alerts, and security updates.
• The lab produces a predictable dependency alert without leaving an intentionally vulnerable package on the default branch.
• Learners identify whether the package is direct or transitive and review the advisory, affected range, patched version, and severity.
• Learners review or create a remediation pull request and run the project tests against the update.
• The alert is verified as resolved after the safe version is merged.
• The exercise discusses grouped updates, compatibility risk, dismissals, and remediation ownership.
• Timing and no-fix-available scenarios have documented fallback data.
• The content coordinates with #237 rather than duplicating its repository-wide Dependabot configuration work.

Start by reviewing the existing workshop structure and issue #237 to understand the repository-wide Dependabot configuration work and avoid duplication. Define how the lab will use an isolated dependency fixture or maintainer-selected advisory, including fallback data for timing and no-fix scenarios. Done means the documented exercise covers alert discovery, risk review, remediation testing, safe merging, resolution verification, and the listed workflow topics.