ci: test Python 3.13, check migrations, schema, deploy and audit

- Matrix 3.10-3.13; pip cache keyed on the requirements.
- New steps: makemigrations --check, spectacular --validate
  --fail-on-warn, check --deploy --fail-level ERROR, pip-audit of the
  installed environment (the Django 4.2.30 advisories are ignored until
  the Django 5.2 upgrade), and a Docker image build.
- The separate vrtManager unittest run is dropped; manage.py test
  already runs those tests.
- CodeQL also runs on pull requests to master.
- Docker installs into a plain venv instead of using the distro's
  python3-lxml and python3-libvirt; lxml>=6.1, since the distro's
  lxml 5.2.1 has CVE-2026-41066.
- dev requirements add ruff and pip-audit.

.github/workflows/codeql-analysis.yml

@@ -9,7 +9,7 @@ on:
   push:
     branches: [master]
   pull_request:
-    branches-ignore: [master]
+    branches: [master]
   schedule:
     - cron: '0 21 * * 3'