ci(security): vendor devkit's secrets-and-sast workflow

Public-consumer + private-source mismatch: marquis is public,
eSolia/devkit is private. GitHub blocks public repos from calling
private reusable workflows even within the same org — same constraint
that applies cross-org. The first two attempts at a direct caller
failed at workflow startup (0s, no jobs).

Fix: vendor the workflow locally, matching the pattern used in
RickCogley/pub-cogley and RickCogley/tedasuke. Wrapper security.yml
now triggers a local secrets-and-sast-vendored.yml.

Also adds .gitignore override for global *secret* pattern, which
matches the vendored filename.

Updates the audit's mental model: the constraint isn't 'cross-org',
it's 'public consumer + private source'. eSolia/marquis hits this
within-org because of the visibility mismatch.

InfoSec: restores SAST + secret scanning + SBOM coverage. Vendored
copy is identical to the same upstream commit (c07c51c) used by
all other vendoring consumers.

Author: RickCogley