GitHub security workshop: Add dependency risk and remediation workflow

首先审查现有的 workshop 结构和 issue #237，以了解整个 repository 范围内的 Dependabot 配置工作并避免重复。确定 lab 将如何使用隔离的 dependency fixture 或由 maintainer 选择的 advisory，包括用于 timing 和无 fix 场景的回退数据。当记录的练习涵盖 alert 发现、风险审查、remediation 测试、安全合并、解决验证以及列出的 workflow 主题时，即表示完成。

Goal

Teach learners to identify, prioritize, and remediate vulnerable dependencies using the dependency graph, Dependabot alerts, security updates, and pull-request checks.

Scope

Use a deterministic and isolated dependency fixture or a maintainer-selected advisory rather than permanently weakening the application dependencies. Cover direct versus transitive dependencies, advisory and severity information, compatibility review, update PRs, and post-merge verification.

Acceptance criteria

• Learners enable or verify the dependency graph, Dependabot alerts, and security updates.
• The lab produces a predictable dependency alert without leaving an intentionally vulnerable package on the default branch.
• Learners identify whether the package is direct or transitive and review the advisory, affected range, patched version, and severity.
• Learners review or create a remediation pull request and run the project tests against the update.
• The alert is verified as resolved after the safe version is merged.
• The exercise discusses grouped updates, compatibility risk, dismissals, and remediation ownership.
• Timing and no-fix-available scenarios have documented fallback data.
• The content coordinates with #237 rather than duplicating its repository-wide Dependabot configuration work.