ci(security): security + license approval policies (DPG)
Versioned GitLab Security Orchestration Policies in .gitlab/security-policies/policy.yml: (1) require approval on HIGH/CRITICAL vulns across all scanners, (2) DPG license compliance (deny AGPL/GPL/SSPL/BUSL). After merge: link the project as its own security policy project (Settings → Security → Policies → Policy project = self).