build(deps-dev): bump tailwindcss from 3.4.17 to 4.3.3

.github/codeql-config.yml

@@ -0,0 +1,8 @@
+# Paths that are not part of the application a visitor runs: the test suite, the
+# developer tooling and the vendored libraries. Third-party code is tracked by
+# Dependabot and by its own maintainers, not by these queries.
+paths-ignore:
+  - tests
+  - .dev
+  - assets/vendor
+  - assets/css

.github/dependabot.yml

@@ -0,0 +1,24 @@
+version: 2
+
+updates:
+  # The workflows use actions published by GitHub and by the community; a
+  # compromised or outdated action runs with the repository's token.
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+      day: 'monday'
+    open-pull-requests-limit: 3
+    groups:
+      actions:
+        patterns:
+          - '*'
+
+  # Tailwind is the only dependency, and it only builds the CSS. An update that
+  # changes the output would be caught by the css job, which rebuilds and diffs.
+  - package-ecosystem: 'npm'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+      day: 'monday'
+    open-pull-requests-limit: 3

.github/workflows/codeql.yml

@@ -0,0 +1,37 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly, so a new query pack reaches the code without a commit.
+    - cron: '23 4 * * 1'
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze PHP
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: php
+          # The project has no build step: the queries run on the sources.
+          config-file: ./.github/codeql-config.yml
+
+      - uses: github/codeql-action/analyze@v3
+        with:
+          category: '/language:php'