security: add SAST/DAST scanning as a CI gate (medium/high fail)

[fpigeonjr]

Parent

• sam-ui-elements pipeline modernization + Angular 19→21 upgrade (SAM Angular upgrade — 4th tracer bullet) — IAEMOD-61187 #562 (sam-ui-elements pipeline modernization + Angular 19→21 upgrade — IAEMOD-57412)

What to build

Add static (SAST) and dynamic (DAST) security scanning as a required CI gate on GSA/sam-ui-elements, failing the build on medium- and high-severity findings introduced by new code.

Closes the QASP "Secure" gap: this repo has no security tooling at all today (no CI, no Dependabot yet — those arrive via #561/#569). The QASP requires new code to be "free of medium- and high-level static and dynamic security vulnerabilities." This is the one QASP item with no coverage anywhere in the #562 issue tree.

Scope it to this repo's reality: sam-ui-elements is a raw-TypeScript-source library (no ng-packagr build — the consumer compiles it in-place), Angular 19→21, with a test-app Karma harness and GitHub Actions being stood up. A reasonable shape is CodeQL (TypeScript/JS + Actions) for the static side plus a dependency/artifact scan for the dynamic side — tool choice is an implementation detail provided the gate fails on medium/high.

New-code gate: pre-existing findings are triaged/burned down, not red-walled up front (ADR-0010). Mirrors GSA/sam-styles#809, GSA/ngx-uswds-icons#99, and GSA/ngx-uswds#272.

Acceptance criteria

• A SAST scan runs in CI on every PR and on master
• A DAST-style scan (dependency / artifact / runtime surface) runs in CI
• The gate fails the build on medium- or high-severity findings on new code
• Pre-existing findings are documented/triaged rather than blocking initial rollout
• Wired as a required status check (or documented as needing DevSecOps if branch protection is admin-owned)
• Complements — does not replace — the Dependabot config being stood up in Dependabot + CI: stand up, then auto-merge minor/patch (human-gate majors) #561

Blocked by

• CI test + coverage workflow (first GitHub Actions CI) #569 (first CI must exist before a scan can be gated in it)

Refs IAEMOD-57412.