fix: resolve all security vulnerabilities and Dependabot alerts

[fgatti675]

Summary

Resolves all 38 open Dependabot security PRs and addresses additional security issues found in the codebase.

Changes

Security Infrastructure

• ✅ Fix broken CodeQL workflow — upgrade deprecated actions v1→v3, checkout v3→v4
• ✅ Add SECURITY.md — vulnerability disclosure policy
• ✅ Add .github/dependabot.yml — automated dependency update configuration

Removed

• ✅ Delete typesense_marketplace/ — unused, was source of 8 Dependabot alerts

Demo Backend (demo_backend/functions)

• ✅ firebase-admin v11→v13 (modular imports migration)
• ✅ firebase-functions v4→v6 (v1 compat imports)
• ✅ axios, express, @google-cloud/firestore, @grpc/grpc-js bumped
• ✅ All 4 source files migrated, build passes with zero errors

Core Packages

• ✅ npm-run-all→npm-run-all2 (maintained fork) in 4 packages
• ✅ listr→listr2 in @firecms/cli
• ✅ execa v4→v9 in @firecms/cli
• ✅ ncp→fs-extra in @firecms/cli
• ✅ markdown-it ^14.1→^14.2 (fixes CVE-2026-2327, CVE-2026-48988)

Website (website-astro)

• ✅ astro, @astrojs/mdx, @astrojs/starlight, astro-expressive-code bumped
• ✅ npm audit fix for transitive vulnerabilities

Dependabot PRs this closes

Closes #834, #836, #837, #839, #840, #843, #844, #845, #847, #849, #851, #852, #853, #854, #855, #856, #857, #862, #863, #864, #865, #866, #867, #868, #869, #870, #871, #872, #874, #875

Testing

• demo_backend/functions: npm run build passes with zero errors
• website-astro: npm install + npm audit fix clean
• Root: yarn install resolves all new deps (pre-existing esbuild native binary issue on Node 25 is unrelated)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.