GitHub security workshop: Add dependency risk and remediation workflow

Goal

Teach learners to identify, prioritize, and remediate vulnerable dependencies using the dependency graph, Dependabot alerts, security updates, and pull-request checks.

Scope

Use a deterministic and isolated dependency fixture or a maintainer-selected advisory rather than permanently weakening the application dependencies. Cover direct versus transitive dependencies, advisory and severity information, compatibility review, update PRs, and post-merge verification.

Acceptance criteria

• Learners enable or verify the dependency graph, Dependabot alerts, and security updates.
• The lab produces a predictable dependency alert without leaving an intentionally vulnerable package on the default branch.
• Learners identify whether the package is direct or transitive and review the advisory, affected range, patched version, and severity.
• Learners review or create a remediation pull request and run the project tests against the update.
• The alert is verified as resolved after the safe version is merged.
• The exercise discusses grouped updates, compatibility risk, dismissals, and remediation ownership.
• Timing and no-fix-available scenarios have documented fallback data.
• The content coordinates with #237 rather than duplicating its repository-wide Dependabot configuration work.

Beginne damit, die bestehende Workshop-Struktur und Issue #237 zu prüfen, um die repositoryweite Dependabot-Konfigurationsarbeit zu verstehen und Doppelungen zu vermeiden. Lege fest, wie das Lab ein isoliertes Dependency-Fixture oder ein von Maintainer ausgewähltes Advisory verwenden wird, einschließlich Fallback-Daten für Timing- und Szenarien ohne Fix. Als abgeschlossen gilt die Aufgabe, wenn die dokumentierte Übung das Auffinden von Alerts, die Risikoprüfung, das Testen der Behebung, das sichere Mergen, die Verifizierung der Auflösung und die aufgeführten Workflow-Themen abdeckt.