chore: modernize CI/CD, Docker infrastructure, and add SECURITY.md

[Saketkesar]

Summary

This PR modernizes the project's CI/CD pipeline, Docker infrastructure, and adds a SECURITY.md policy — ensuring all educational lessons and intentional vulnerabilities remain 100% functional and tested.

Changes

CI/CD Modernization

• Upgrade GitHub Actions from deprecated v1/v2 to v4 (actions/checkout, actions/setup-node, actions/cache, actions/upload-artifact) to prevent workflow failure from GitHub action deprecations.
• Pin E2E runner to ubuntu-22.04 to preserve full compatibility with Cypress 3.x dependencies.
• Add server readiness polling before Cypress runs to eliminate race conditions during background server startup.
• Universal linter step that runs jshint cleanly across all Node versions.
• Node Matrix: Tested across Node 12.x, 14.x, and 16.x for E2E tests, and 14.x, 16.x, 18.x for linting.
• Update CI MongoDB from 4.0 to 4.4 to match docker-compose.

Docker Modernization

• Upgrade Dockerfile base image to node:14-alpine to guarantee 100% compatibility with all NodeGoat lessons and dependencies.
• Add CMD instruction to Dockerfile (["node", "server.js"]).
• Remove deprecated version field from docker-compose.yml.
• Add MongoDB healthcheck & depends_on condition in docker-compose.yml so the app starts only after the database is ready.
• Add restart: unless-stopped policies.

Security Policy

• Add SECURITY.md clarifying that application vulnerabilities are intentional for teaching OWASP Top 10, and providing responsible disclosure instructions for project infrastructure.

Verification & Test Results

• ✅ Lint Workflow: 100% Passed across Node 14.x, 16.x, and 18.x
• ✅ E2E Test Suite (13 specs): 100% Passed across Node 12.x, 14.x, and 16.x (All tutorial specs, auth specs, contributions, allocations, XSS, etc. pass completely)
• ✅ Zero Application Code Changes: All intentional vulnerabilities and learning exercises are fully preserved.