ci(security): audit only declared runtime deps, not the runner env

[kallioli]

Context

The security job runs pip-audit --skip-editable against the
job's Python environment. That picks up every package installed in
the runner — pip, setuptools, wheel, and the rest of the tooling —
alongside orca's actual runtime deps. The build then fails on
advisories that have nothing to do with orca's supply chain.

Latest example, blocking #7 and #8 today:

Found 1 known vulnerability in 1 package
Name Version ID            Fix Versions
---- ------- ------------- ------------
pip  26.0.1  CVE-2026-3219

A vuln in pip itself is a runner-environment problem, not an
orca problem. Pinning around it would be a treadmill: every new
pip CVE would block unrelated PRs.

Changes

.github/workflows/ci.yml, security job:

• Drop pip install -e . (no need to install the project — we're
  not auditing the resolved env any more).
• Install poetry + poetry-plugin-export>=1.7 + pip-audit.
  The plugin is bundled in poetry < 2.0 but split out in poetry 2.x;
  pinning it explicitly keeps the step working on either side.
• Run poetry export --only main --without-hashes to a temp file
  containing only orca's declared runtime deps.
• Run pip-audit --requirement /tmp/runtime-requirements.txt.

The audit surface now matches what users actually install when they
pip install orca-openstackclient. Tooling vulns in the runner
can no longer block PRs.

Tests

YAML validated locally; the substantive test is the next CI run on
this PR — if pip-audit no longer fails on CVE-2026-3219 the change
is doing its job.

Risks

• Reduced audit surface: we no longer scan transitive vulns in
  build tooling. Acceptable: those tools don't ship with orca, and
  the CI runner image is GitHub-managed (vulns there would be
  GitHub's responsibility, not ours).
• Adds a poetry install step: minor (~5 s on a cold cache).
  actions/setup-python@v5 already caches pip wheels.

Recommended merge order

This PR first — it unblocks the security job for both #7 and #8.