CI: add pip-audit security scanning

[dannywillems]

Summary

• Add pip-audit to dev dependencies for security vulnerability scanning
• Add security audit step to CI workflow
• Require Python 3.13+ (drop support for older versions)
• Update Poetry from 1.4.0 to 2.3.1
• Fix deprecated [tool.poetry.dev-dependencies] → [tool.poetry.group.dev.dependencies]
• Update actions/checkout from v2 to v4
• Update actions/setup-python from v2 to v5
• Fix black formatting issues

Test plan

• Verify CI passes on all platforms (ubuntu, macos, windows)
• Verify pip-audit runs successfully