GitHub security workshop: Add dependency risk and remediation workflow

Goal

Teach learners to identify, prioritize, and remediate vulnerable dependencies using the dependency graph, Dependabot alerts, security updates, and pull-request checks.

Scope

Use a deterministic and isolated dependency fixture or a maintainer-selected advisory rather than permanently weakening the application dependencies. Cover direct versus transitive dependencies, advisory and severity information, compatibility review, update PRs, and post-merge verification.

Acceptance criteria

• Learners enable or verify the dependency graph, Dependabot alerts, and security updates.
• The lab produces a predictable dependency alert without leaving an intentionally vulnerable package on the default branch.
• Learners identify whether the package is direct or transitive and review the advisory, affected range, patched version, and severity.
• Learners review or create a remediation pull request and run the project tests against the update.
• The alert is verified as resolved after the safe version is merged.
• The exercise discusses grouped updates, compatibility risk, dismissals, and remediation ownership.
• Timing and no-fix-available scenarios have documented fallback data.
• The content coordinates with #237 rather than duplicating its repository-wide Dependabot configuration work.

Comienza revisando la estructura existente del workshop y el issue #237 para entender el trabajo de configuración de Dependabot en todo el repositorio y evitar duplicaciones. Define cómo usará el lab un fixture de dependencias aislado o un advisory seleccionado por un maintainer, incluidos datos de respaldo para los escenarios de temporización y de ausencia de fix. Se considera terminado cuando el ejercicio documentado cubre el descubrimiento de alertas, la revisión de riesgos, las pruebas de remediación, el merge seguro, la verificación de la resolución y los temas de workflow indicados.