Add slither job to Security Scan workflow; use latest Node LTS in CI

[OBrezhniev]

Summary

Adds a slither job to .github/workflows/security-ci.yml, alongside solhint and coverage.

• Installs Node 24.12.0 + npm ci, then slither-analyzer==0.11.6 via pip.
• Runs slither . --sarif results.sarif --fail-none using the repo's existing slither.config.json.
• Uploads the SARIF to GitHub Code Scanning (category slither). Permissions: contents: read, security-events: write.

Why it doesn't fail on findings

Slither currently reports 54 High results on master (51 incorrect-return in the snarkjs-generated Groth16 verifiers, 2 arbitrary-send-eth in the payment _withdraw functions, 1 encode-packed-collision in VerifierLib). All of them have been triaged. Gating the job on them would make it red from the start. With SARIF upload, each false positive is dismissed once in Code Scanning and only new alerts need attention. Once that backlog is cleared, we can switch the job to fail on High findings (--fail-high).

Before merging

Code Scanning must be enabled for this repo (Settings → Code security). Otherwise the upload step fails.

Testing

Ran the same command locally on master: exit 0, valid SARIF 2.1.0 with 971 results. This PR's CI run is the first time the workflow runs on GitHub.

Node version

All workflows (Tests, Security Scan, npm publish) now use node-version: "lts/*" instead of pinning 24.12.0, so CI always runs on the latest Node LTS. Note: this includes the npm publish job, and it will move to the next LTS line automatically when one is released.

package-lock.json

The current LTS (Node 24.21 / npm 11.19) makes npm ci fail with Missing: bufferutil@4.1.0 from lock file. bufferutil is an optional peer dependency of ws. This PR adds only that lock entry: no other package versions change, and npm 11.6 (Node 24.12) still accepts the lock.

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.