Harden dependency and image security checks

[jmecom]

Run OSV across Buzz's Cargo, pnpm, Flutter, and uv lockfiles on every CI execution, enforce dependency review and both Cargo policies, and scan CocoaPods plus every built relay, debug, push-gateway, and Sprig image.

Fix the currently actionable Rust, JavaScript, and Python findings. Remaining upstream-only findings have concrete reasons and expiration dates, while container scans fail on high or critical findings once a vendor fix exists. Benchmark installs now use frozen uv locks, and uv plus Trivy are pinned through Hermit.

Checked with just ci, just benchmark-check, recursive OSV and Cargo policy scans, frozen pnpm/Flutter lockfile checks, and CocoaPods and published-image scans.