ci: add Brakeman and bundle-audit security scan job (#15169)

.github/workflows/run_foss_spec.yml

@@ -21,6 +21,24 @@ jobs:
       - name: Run Rubocop
         run: bundle exec rubocop --parallel
 
+  security-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+      - name: Run Brakeman
+        # Non-blocking for now: Brakeman surfaces 35 pre-existing findings
+        # (13 High confidence) that need security-team triage before this
+        # can be turned into a hard gate.
+        continue-on-error: true
+        run: bundle exec brakeman -q --no-pager
+      - name: Run bundle-audit
+        run: |
+          bundle exec bundle-audit update
+          bundle exec bundle-audit check
+
   lint-frontend:
     runs-on: ubuntu-latest
     steps: