ci: test Python 3.13, check migrations, schema, deploy and audit

- Matrix 3.10-3.13; pip cache keyed on the requirements.
- New steps: makemigrations --check, spectacular --validate
  --fail-on-warn, check --deploy --fail-level ERROR, pip-audit of the
  installed environment (the Django 4.2.30 advisories are ignored until
  the Django 5.2 upgrade), and a Docker image build.
- The separate vrtManager unittest run is dropped; manage.py test
  already runs those tests.
- CodeQL also runs on pull requests to master.
- Docker installs into a plain venv instead of using the distro's
  python3-lxml and python3-libvirt; lxml>=6.1, since the distro's
  lxml 5.2.1 has CVE-2026-41066.
- dev requirements add ruff and pip-audit.

dev/requirements.txt

@@ -7,3 +7,5 @@ pyflakes==4.0.0
 pylint==4.0.9
 yapf==0.43.0
 black==26.5.1
+pip-audit==2.10.1
+ruff==0.16.10