Replace Trivy with OSV-Scanner and switch docs from pipx to uv

[GRodolphe]

Summary

• Removed Trivy from the CI and release workflows
• Added OSV-Scanner (osv.dev) using the official google/osv-scanner-action reusable workflow, v2.3.8
• Switched the docs from pipx to uv for installation and development

Details

• ci.yml: new osv-scan job, build now waits for it. The old commented out Trivy container job is gone too.
• release.yml: osv-scan runs as a gate before build and publish. The trivy JSON files are no longer attached to releases.
• Scan results now land in the GitHub Security tab (SARIF) instead of JSON artifacts.
• README.md: quick start and dev setup use uv tool install, uv venv and uv pip install. Security tools list now covers OSV-Scanner.
• SECURITY.md: dependency scanning now lists Safety and OSV-Scanner.

Related to #1 (the uv part).

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️