fix(security): complete allowlist input validation audit

[TFT444]

Summary

• add centralized allowlist, type, format, and size validation for API inputs
• validate scan/findings paths, query parameters, AI payloads, request IDs, auth headers, and Sentinel ingestion data
• document every reviewed boundary and update the OpenSSF Silver evidence register
• add security regression coverage for malformed, oversized, duplicated, and injection-style inputs

Validation

• ruff check .
• ruff format --check .
• 511 passed, 3 skipped with 84.42% API/scanner coverage
• frontend lint, i18n, accessibility, and production build
• website URL security tests
• Bandit: no medium/high findings
• pip-audit and both npm audits: 0 vulnerabilities

Closes #201

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None