Add bundler-audit to the local gate and CI (herb-embedded-fa6)

[jleo3]

Summary

• guides.rubygems.org/security recommends running bundler-audit against ruby-advisory-db in CI: it catches "the exact versions currently pinned in Gemfile.lock have a known CVE" immediately, a different signal from Dependabot's weekly "a newer version exists" check.
• Wires Bundler::Audit::Task (the gem's own Rake::TaskLib, matching how RSpec::Core::RakeTask/RuboCop::RakeTask are already used in this Rakefile) into the default rake task.
• Local runs use bundle:audit (check-only — auto-clones the advisory db if missing, but doesn't force-refresh an existing clone, to avoid requiring network access on every bundle exec rake).
• CI explicitly runs bundle:audit:update before bundle:audit:check, so it never checks against a stale snapshot regardless of what a prior run left behind.

Note: CI doesn't currently invoke the full rake default task (it calls bundle:build and rspec as separate explicit steps, meaning rubocop has never run in CI either) — this PR deliberately doesn't change that, adding bundler-audit as its own explicit step instead. Flagging the pre-existing "CI never runs rubocop" gap for awareness; it's out of this bead's scope.

Acceptance criteria

• bundler-audit runs as part of bundle exec rake and as part of CI.
• A CI run against the current Gemfile.lock passes cleanly — verified locally: "No vulnerabilities found", both via a fresh database pull (1233 advisories) and the cached check.
• The advisory database is kept current in CI, documented how — bundle:audit:update runs before bundle:audit:check in the CI step; the Rakefile comments explain the local/CI asymmetry.
• bundle exec rake passes locally: 206 examples, 0 failures, 0 RuboCop offenses, no vulnerabilities found.

Test plan

• bundle exec rake bundle:audit:check standalone: clean.
• bundle exec rake bundle:audit:update bundle:audit:check (matching the exact CI invocation): database refreshed, then clean.
• Full bundle exec rake: all green.

🤖 Generated with Claude Code