Release v1.1.2: publish container image + add security workflows

- Bump VERSION to 1.1.2 (no app behavior change from 1.1.1).
- release.yml: add workflow_dispatch so images can be published manually from
  the Actions tab in addition to on version tags.
- Add CodeQL code scanning (Python + JavaScript), free for public repos.
- Add Dependabot config for GitHub Actions and pip updates.

This is the first release to publish a multi-arch image to GHCR
(ghcr.io/allennpit/ads-bit).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+# Static security analysis (free for public repositories). Scans the Python
+# backend and the vanilla-JS frontend on pushes, PRs, and weekly.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "23 5 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, javascript]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+      - name: Analyze
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/release.yml

@@ -7,6 +7,12 @@ name: Release
 on:
   push:
     tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Image tag to publish (e.g. 1.1.2); leave blank for just :latest"
+        required: false
+        default: ""
 
 permissions:
   contents: read
@@ -40,6 +46,7 @@ jobs:
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=${{ inputs.version }},enable=${{ github.event_name == 'workflow_dispatch' && inputs.version != '' }}
             type=raw,value=latest
 
       - name: Build and push