Add security-checkov workflow (scan Dockerfiles and workflows)

[lockwobr]

Part of #54.

Summary

Add .github/workflows/security-checkov.yaml: run Checkov security scanning on PRs and pushes. Source: NVIDIA/nodewright/.github/workflows/security-checkov.yaml.

Behavior (from nodewright)

• Trigger: pull_request and push to main, filtered to the relevant paths.
• Runs bridgecrewio/checkov-action@v12.3102.0.
• In nodewright it scans the Helm chart (framework: helm, directory: chart).

Adaptation required (the key change)

1. No Helm chart here; retarget Checkov. This repo has no chart/. It does have eight package Dockerfiles (nvidia-setup/, nvidia-tuning-gke/, kdump/, copy-fail/, tuned/, shellscript/, tuning/, nvidia-tuned/). Retarget Checkov to:
   • framework: dockerfile over the repo (or per package), and
   • framework: github_actions over .github/workflows/** (recommended, since this is a workflow-heavy repo).
     Drop the HELM_NAMESPACE env and the helm framework.
2. Path filters. Trigger on **/Dockerfile and .github/workflows/** changes rather than chart/**.
3. ci-gate. Same open decision as commit-linting: keep the ci-gate composed-check job or make checkov directly required. Match whatever pr_build.yaml uses.

Conventions

• SPDX header matching stale.yaml.
• Keep FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true as nodewright does.
• Pin bridgecrewio/checkov-action to the version nodewright uses (v12.3102.0).

Acceptance

• Changes to a package Dockerfile or a workflow trigger a Checkov scan.
• Findings are reported in the PR; severity-to-fail policy is decided (start non-blocking if noisy, then tighten).