ci: add --disable-pip --no-deps --skip-editable to pip-audit

[griase94]

Summary

The release-on-tag workflow runs on the hetzner runner image, which does not ship python3.12-venv. Without --disable-pip, pip-audit falls back to a pip-based path that tries to spin up an internal venv to resolve the requirements file, and crashes with:

The virtual environment was not created successfully because ensurepip is not available.
On Debian/Ubuntu systems, you need to install the python3-venv package using the following command.
    apt install python3.12-venv

The CI workflow runs on ubuntu-latest (which has venv installed), so it never hit this. Adding the flags so the audit works on every runner — the exported requirements are already pinned with hashes, so pip-audit doesn't need to resolve anything; it just looks each package up in the OSV database.

Same flags the worker SDK already uses for the same reason.

Test plan

• make audit runs locally → No known vulnerabilities found
• After merge: re-tag v1.4.0 (or bump to v1.4.1) and the release workflow's audit step passes