fix: resolve GitHub Actions security workflow failures

- Update CodeQL actions from v2 to v3 to fix deprecation warnings
- Fix CSP validation script to handle empty results properly
- Add security-events write permission to vulnerability scan job
- Improve npm audit handling to only fail on high/critical vulnerabilities

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: Wolfe-Jam

.github/workflows/security.yml

@@ -27,7 +27,18 @@ jobs:
         run: npm ci
 
       - name: npm audit
-        run: npm audit --audit-level moderate --json > audit-results.json || true
+        run: |
+          npm audit --audit-level moderate --json > audit-results.json || exit_code=$?
+          if [ -n "$exit_code" ] && [ "$exit_code" -ne 0 ]; then
+            echo "⚠️ npm audit found vulnerabilities (exit code: $exit_code)"
+            cat audit-results.json | jq '.vulnerabilities | to_entries | map(select(.value.severity == "high" or .value.severity == "critical")) | length' > /dev/null 2>&1 && \
+            high_vulns=$(cat audit-results.json | jq '.vulnerabilities | to_entries | map(select(.value.severity == "high" or .value.severity == "critical")) | length')
+            if [ "$high_vulns" -gt 0 ]; then
+              echo "❌ Found $high_vulns high/critical vulnerabilities"
+              exit 1
+            fi
+          fi
+          echo "✅ Security audit completed"
       
       - name: Upload audit results
         uses: actions/upload-artifact@v4
@@ -48,13 +59,13 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v3
         with:
           languages: javascript
           queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v3
 
   # Extension Permission Audit
   permission-audit:
@@ -107,7 +118,7 @@ jobs:
             exit 1
           fi
           
-          if find public -name "*.html" -exec grep -l "<script>" {} \;; then
+          if find public -name "*.html" -exec grep -l "<script>" {} \; 2>/dev/null | grep -q .; then
             echo "⚠️  Found inline script tags - ensure they comply with CSP"
           fi
           
@@ -123,6 +134,10 @@ jobs:
   vulnerability-scan:
     name: 🚨 Dependency Vulnerabilities
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
     steps:
       - uses: actions/checkout@v4
 
@@ -135,9 +150,10 @@ jobs:
           output: 'trivy-results.sarif'
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: 'trivy-results.sarif'
+        if: always()
 
   # Generate security report
   security-report: