Chore/security workflow scheduling

[akinboyewaSamson]

closes #121

Description
Problem: Our security scanning (using cargo-audit and cargo-deny) was previously configured to run solely on a weekly schedule. While helpful for baseline auditing, this left a wide gap where new vulnerabilities could be merged without warning. Since PR-time evaluation is our most valuable line of defense, and daily checks help catch fresh advisories as soon as they are published, the weekly cadence was insufficient for our security posture.

Solution: This PR restructures the security.yml GitHub Actions workflow to operate on a three-tier schedule:

PR-Time (Sentinel Check): Triggers on all pull requests to block vulnerable dependencies from ever entering the main branch.
Nightly (Fresh Advisory Catch): Runs daily at 02:00 UTC to provide the earliest possible detection of newly published RustSec advisories affecting our existing codebase.
Weekly (Baseline Catch-all): Retains the Monday 08:00 UTC schedule as a guaranteed, low-noise baseline.
Changes Made
.github/workflows/security.yml:
Added the pull_request trigger to the workflow.
Added a new daily cron schedule - cron: '0 2 * * *' (02:00 UTC).
Preserved the existing weekly cron schedule - cron: '0 8 * * 1' (Monday 08:00 UTC).
Updated the inline documentation headers to reflect the new three-tier rationale.
Type of Change
Security/Infrastructure update (improves vulnerability detection)
How Has This Been Tested?
YAML Validation: Verified that the syntax for multiple schedule blocks and the pull_request triggers are compliant with GitHub Actions standards.

[usmanimamu17-create]

Thanks for tightening up the security workflow! Quick clarification: the green "Dependency Policy (cargo-deny)" and "Dependency Security Audit" runs you can see came from security.yml re-firing because this PR edits that workflow file. They are not the per-PR gate.

For the merge gate we rely on the four jobs in ci.yml: client-checks, e2e-tests, fuzz-tests, and provenance-hashes — and none of them have registered a run here. If you rebase onto the latest main and push again, the per-PR CI should kick off. Once all four jobs are green I will merge right away. 🙏