fix: add env to ignore node js deprecation errors

fix: pin trivy-action to stable version

feat: GitHub Actions CI/CD — security scan on push/PR, LLM eval on schedule