feat: ZAP penetration testing for backend

[DerekRoberts]

New backend in place. Add penetration testing and reporting.

[RMCampos]

@DerekRoberts maybe we can use something like this?

GHA: https://github.com/zaproxy/action-full-scan

It's simple and seems to work fine. wdyt?

Quick article (1 year old): https://dev.to/cheahengsoon/security-testing-with-zap-and-github-actions-4kae

[DerekRoberts]

@RMCampos That's it exactly. :D