security: fix 9 Dependabot/CodeQL alerts (DOMPurify, vite, uuid, workflow permissions) (#617)

* security: fix 9 Dependabot/CodeQL alerts — DOMPurify, vite, uuid, workflow permissions

- Add explicit permissions block to defender-for-devops.yml (CodeQL #25)
- Upgrade vite 5.4.x → 6.4.3; bundled esbuild 0.21.5 → 0.25.12 (Dependabot #2, #7)
- Force dompurify ^3.4.0 via npm overrides; resolves 6 DOMPurify XSS alerts (#4–#6, #8–#11)
- Force uuid ^13.0.1 via npm overrides; fixes buffer bounds check (Dependabot #12)

* fix(ci): exclude bandit from MSDO scan on windows-latest

bandit_runner.exe builds a per-file command line; on a large Python repo
the total command string exceeds the Windows CreateProcess limit and the
process fails to start (Win32 ERROR_FILENAME_EXCED_RANGE 206).
Exclude bandit via the tools param and retain checkov, eslint,
templateanalyzer, terrascan, and binskim.

* fix(ci): drop binskim (no binaries), enable Neptune audit logging

- Remove binskim from MSDO tools: repo has no compiled binaries so
  BinSkim raises AnalyzeArgumentNoValuesException and breaks the run
- Add EnableCloudwatchLogsExports: [audit] to NeptuneCluster to fix
  Checkov CKV_AWS_101 (the one error-level result breaking the build)

.github/workflows/defender-for-devops.yml

@@ -26,6 +26,10 @@ on:
   schedule:
     - cron: '43 17 * * 6'
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   MSDO:
     # currently only windows latest is supported
@@ -41,6 +45,8 @@ jobs:
     - name: Run Microsoft Security DevOps
       uses: microsoft/security-devops-action@v1.6.0
       id: msdo
+      with:
+        tools: checkov,eslint,templateanalyzer,terrascan
     - name: Upload results to Security tab
       uses: github/codeql-action/upload-sarif@v3
       with: