Use pip-audit to scan Python dependencies for known vulnerabilities

[mr-tz]

https://github.com/trailofbits/gh-action-pip-audit

[williballenthin]

current status:

which leads to this very long issue:
pytest-dev/py#287

once pytest can release an update (or the CVE and other metadata is yanked) then I think we should add this.

[kami922]

Hello @mr-tz @williballenthin , the pip-audit.yml workflow file was added at some point but the issue was never closed. I noticed both actions are unpinned (using mutable tags @v4 and @v1.0.8), while every other workflow in capa pins to commit SHAs for supply chain security. I have opened PR to pin both SHAs and bump pip-audit to the latest stable v1.1.0. Let me know your thoughts on this. It was a very small fix. I worked on something similar in last PR.