chore(release): v4.0.3

[CakeRepository]

Summary

Patch release that ships everything merged since 4.0.2:

• chore(deps): bump vitest to 4.1.11, resolve all Dependabot alerts #29: vitest → ^4.1.11. Clears all 14 Dependabot alerts; npm audit reports 0 vulnerabilities. The CI matrix is now Node 20 / 22 / 24.
• docs: add SECURITY.md with public vulnerability reporting policy #30: SECURITY.md sets out the public vulnerability reporting policy.

This PR bumps the version to 4.0.3 in package.json, package-lock.json, server.json, and SERVER_VERSION in src/config.ts, and cuts the CHANGELOG entry. Runtime dependencies are unchanged.

After merge: create GitHub Release v4.0.3 on master so publish.yml publishes to npm.

Test plan

• npm run clean && npm ci && npm run build && npm run lint && npm test: 104/104 pass
• npm audit: 0 vulnerabilities
• npm pack --dry-run: @takescake/1password-mcp@4.0.3
• All three version strings agree (checked by publish.yml)
• CI green on Node 20 / 22 / 24

🤖 Generated with Claude Code