Added github actions security plugin

.github/dependency-check-suppressions.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+    <!-- Add false-positive suppressions here as needed. Example:
+    <suppress>
+        <notes>False positive: not applicable to this project</notes>
+        <cve>CVE-XXXX-XXXXX</cve>
+    </suppress>
+    -->
+</suppressions>

.github/workflows/security.yml

@@ -0,0 +1,107 @@
+name: Security Scan
+
+on:
+  pull_request:
+    branches: ["**"]
+  push:
+    branches: [main, develop]
+  schedule:
+    - cron: "0 8 * * 1" # weekly Monday 08:00 UTC
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  codeql:
+    name: CodeQL (Java SAST)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: java
+          queries: +security-extended
+
+      - name: Build with Maven
+        run: mvn -B compile -DskipTests -pl sink-connector,sink-connector-lightweight
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:java"
+
+  trivy:
+    name: Trivy Filesystem Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run Trivy (table output for logs)
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: fs
+          scan-ref: .
+          scanners: vuln
+          severity: CRITICAL,HIGH
+          exit-code: "1"
+          format: table
+          trivy-config: trivy.yaml
+
+      - name: Run Trivy (SARIF for GitHub Security tab)
+        uses: aquasecurity/trivy-action@master
+        if: always()
+        with:
+          scan-type: fs
+          scan-ref: .
+          scanners: vuln
+          severity: CRITICAL,HIGH
+          exit-code: "0"
+          format: sarif
+          output: trivy-results.sarif
+          trivy-config: trivy.yaml
+
+      - name: Upload Trivy SARIF to GitHub Security
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: trivy-results.sarif
+
+  grype:
+    name: Grype Dependency Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run Grype (table output for logs)
+        uses: anchore/scan-action@v6
+        with:
+          path: .
+          fail-build: "true"
+          severity-cutoff: high
+          output-format: table
+
+      - name: Run Grype (SARIF for GitHub Security tab)
+        uses: anchore/scan-action@v6
+        if: always()
+        id: grype-sarif
+        with:
+          path: .
+          fail-build: "false"
+          severity-cutoff: high
+          output-format: sarif
+
+      - name: Upload Grype SARIF to GitHub Security
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: ${{ steps.grype-sarif.outputs.sarif }}
+          category: grype