fix(deps): remediate Scorecard advisories

[JJordan0C]

Summary

Remediate the dependency advisories reported by OpenSSF Scorecard without changing product behavior.

Implementation

• Disable unused default features of statrs 0.18 in needle-bench.
• Remove the transitive nalgebra, simba, and paste dependency chain.
• Update the development-only brace-expansion dependency from 5.0.8 to 5.0.9.
• Document both remediations in SECURITY.md.

Validation

cargo fmt --all -- --check
passed

cargo test --locked --workspace
429 passed, 1 ignored

cargo clippy --locked --workspace --all-targets -- -D warnings
passed

cargo build --locked --workspace
passed

Codex offline integration tests
20 passed

npm audit --audit-level=high
0 vulnerabilities

npm test
13 passed

npm run typecheck
passed

npm run lint
passed

npm run build
passed

npm run test:e2e:local
1 passed

Product and benchmark plugin validation
passed

Proof microbenchmark
passed

git diff --check
passed