feat: add pip-audit, minting the Supply Chain Security section

The PyPA-official dependency vulnerability scanner: 30.9M
downloads/month (pepy; largely CI traffic, which is the use case),
1.3K stars, pushed 2026-08. Verified 2026 guidance names it the free
baseline over the older commercial safety. Sole obvious choice.

This mints the reform's first new section — an explicit maintainer
override of decision 18 (all minted use cases are subcategories),
accepted in the audit preview. TOC line, heading, and description
ride this commit per the Build Backends pattern; placed alphabetically
in the Security group.

Co-Authored-By: Claude <noreply@anthropic.com>

README.md

@@ -116,6 +116,7 @@ An opinionated guide to the best Python frameworks, libraries, tools, and resour
 
 - [Cryptography](#cryptography)
 - [Penetration Testing](#penetration-testing)
+- [Supply Chain Security](#supply-chain-security)
 - [Web Security](#web-security)
 
 **Other**
@@ -1099,6 +1100,12 @@ _Frameworks and tools for penetration testing._
 - [sherlock-project](https://github.com/sherlock-project/sherlock) - Hunt down social media accounts by username across social networks.
 - [social-engineer-toolkit](https://github.com/trustedsec/social-engineer-toolkit) - A toolkit for social engineering.
 
+### Supply Chain Security
+
+_Tools for auditing dependencies against known vulnerabilities._
+
+- [pip-audit](https://github.com/pypa/pip-audit) - Audits Python environments and dependency trees for known vulnerabilities, using the PyPI Advisory Database and OSV.
+
 ### Web Security
 
 _Libraries for application-layer web security._