Release v1.1.2: publish container image + add security workflows

- Bump VERSION to 1.1.2 (no app behavior change from 1.1.1).
- release.yml: add workflow_dispatch so images can be published manually from
  the Actions tab in addition to on version tags.
- Add CodeQL code scanning (Python + JavaScript), free for public repos.
- Add Dependabot config for GitHub Actions and pip updates.

This is the first release to publish a multi-arch image to GHCR
(ghcr.io/allennpit/ads-bit).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+# Static security analysis (free for public repositories). Scans the Python
+# backend and the vanilla-JS frontend on pushes, PRs, and weekly.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "23 5 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, javascript]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+      - name: Analyze
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"