fix: remediate dependency and workflow security alerts

[jason-allen-oneal]

Summary

• raise the supported Python floor from 3.9 to 3.10 and regenerate uv.lock, removing the vulnerable Python 3.9-only resolution branch
• add Python 3.10 to CI so the new minimum remains continuously tested
• replace the unhashed runtime pip install in the publication job with pypa/gh-action-pypi-publish pinned to its v1.14.2 commit
• remove redundant workflow-wide CodeQL write permission and split PyPI/GitHub publication so each token is scoped to the job that needs it
• disable release-path dependency caches and checkout credential persistence to keep publishable artifacts out of cache-poisoning and credential-retention paths

Root cause and alert coverage

The lock supported Python 3.9 even though CI starts at Python 3.11. Packages that no longer ship patched Python 3.9 releases forced an obsolete <3.10 resolution branch into uv.lock. That one branch accounts for all 15 open Dependabot alerts:

• filelock: build(deps): bump the web-dependencies group across 1 directory with 13 updates #9, build(deps): bump the github-actions group with 13 updates #10
• requests: fix(deps): remediate web dependency advisories #11
• pytest: build(deps): bump the github-actions group across 1 directory with 12 updates #12
• pip: fix: remediate dependency and workflow security alerts #13, security: track and reconcile remaining OpenSSF Scorecard findings #14, #23
• urllib3: build(deps): bump the web-dependencies group in /web with 3 updates #15, build(deps): bump the github-actions group with 2 updates #16
• Starlette: #17–#21
• msgpack: #22

It also accounts for code-scanning alert #12 (VulnerabilitiesID), whose Scorecard result expands to 17 OSV records across click, filelock, msgpack, pip, pytest, requests, Starlette, and urllib3.

Workflow changes address code-scanning alerts #4 and #14 (TokenPermissionsID) and #15 (PinnedDependenciesID). The remaining repo-level Scorecard alerts (#9 Maintained, #10 Code Review, #11 CII Best Practices, and #13 Fuzzing) are distinct governance, repository-age, or external-integration signals and are not dismissed by this PR.

Compatibility impact

Python 3.9 installations will need to upgrade to Python 3.10 or newer. Python 3.10 is now exercised explicitly in the CI matrix.

Verification

• OpenSSF Scorecard v5.5.0, same version as the hosted run:
  • baseline: Token-Permissions 9, Pinned-Dependencies 9, Vulnerabilities 0 (17 records)
  • branch: Token-Permissions 10, Pinned-Dependencies 10, Vulnerabilities 10 (0 records)
• OSV-Scanner v2.5.1: baseline 8 packages / 17 vulnerabilities; branch 0 issues across uv.lock and web/package-lock.json
• Python 3.10.14: uv sync --locked --extra dev
• uv run pytest -ra --cov=eie --cov=api --cov-report=term-missing: 20 passed
• API contract suite against loopback server: 6 passed
• Ruff, mypy, Bandit, and pip-audit: passed; no known dependency vulnerabilities
• web TypeScript, ESLint, Next.js production build, npm production audit: passed; 0 vulnerabilities
• Playwright Chromium suite: 2 passed
• actionlint v1.7.12, Ruby YAML parse, uv lock --check, and git diff --check: passed
• zizmor v1.30.0: no high-severity findings after release-cache hardening; remaining findings are pre-existing medium/informational hardening recommendations

Pinned review base: bf56c05fa2bf5aa308f533a6dabb94d78405924e.

[morrow-bluedot]

Independent exact-head review at f471f62: all 15 dependency alerts map to the retired Python 3.9 lock branch; workflow permission and immutable-action fixes are scoped correctly. OSV is clean and all 12 hosted CI, container, web, API/E2E, and CodeQL checks pass.