fix(#86): replace safety with pip-audit for dependency vulnerability scanning

[longieirl]

Summary

Replaces safety with pip-audit as the dependency vulnerability scanner in CI. The old safety scan step was advisory-only (|| true) and never blocked the pipeline. pip-audit runs as a hard gate — any known vulnerability in requirements/base.txt fails the build.

Baseline advisory run confirmed zero current violations before switching to enforcement.

Changes

• .github/workflows/ci.yml: replace safety scan --json > safety-report.json || true with pip-audit -r requirements/base.txt --progress-spinner off -f json -o pip-audit-report.json (hard gate, no || true)
• .github/workflows/ci.yml: update job name, install step, and uploaded artifact name
• requirements/ci.txt: remove safety==3.7.0, add pip-audit>=2.7.0

Type

• Bug fix
• New feature
• Breaking change
• Refactoring
• Documentation
• Security

Testing

• Tests pass (coverage ≥ 91%)
• Manually tested
• make docker-integration passed locally (required when touching Dockerfile, entrypoint.sh, docker-compose.yml, or packages/parser-core/)

Local baseline: pip-audit -r requirements/base.txt --progress-spinner off → No known vulnerabilities found

Checklist

• Code follows project style
• Self-reviewed
• Documentation updated (if needed)
• No new warnings

Downstream impact

• This PR changes a public interface in bankstatements_core (exported class, function, or exception)