Fix GitHub security and code quality findings

[matteius]

Summary

• prevent private source and destination file paths from reaching operation logs, resolving CodeQL alerts #34, #35, and #36
• resolve all 35 open GitHub Code Quality findings across the nine reported Python and JavaScript rules
• add regression coverage ensuring file operations log stable managed-file IDs without exposing paths

Quality cleanup

• remove dead assignments, unreachable branches, duplicate imports, and unused variables/imports
• document intentionally ignored exception cases
• align the payment test provider override signature and make transaction callback test doubles explicitly callable
• explicitly export the browser workflow builder used by the admin bootstrap

Verification

• poetry run pytest -q: 707 passed, 1 skipped
• npm test -- --run: 109 passed
• ruff format --check django_forms_workflows/ tests/: passed
• ruff check django_forms_workflows/ tests/: passed
• pre-commit ruff and ruff-format hooks: passed

[Copilot]

Pull request overview

This PR focuses on addressing GitHub security/code-quality findings by preventing sensitive file paths from being emitted to operation logs, cleaning up dead/unused code paths, and adding regression tests to ensure logging remains path-safe.

Changes:

• Sanitizes file-operation logging to avoid emitting source/destination paths; adds regression tests asserting logs contain only managed-file IDs.
• Performs repo-wide quality cleanups (remove unused imports/variables, unreachable branches, dead assignments) and documents intentionally ignored exception cases.
• Aligns test doubles / overrides with updated interfaces and exports the workflow builder for admin bootstrap usage.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/test_workflow_engine.py	Makes on_commit test callback explicitly callable/typed for clearer patching.
tests/test_views.py	Updates payment provider test override signature to match the expected interface.
tests/test_file_handler.py	Adds regression coverage to ensure file operations don’t log private paths.
manage_dev.py	Removes unused import to satisfy lint/code-quality checks.
example_project/example/settings.py	Removes unused import to satisfy lint/code-quality checks.
django_forms_workflows/workflow_engine.py	Removes dead assignments in name lookup logic.
django_forms_workflows/workflow_builder_views.py	Removes dead assignment in sub-workflow config handling.
django_forms_workflows/views.py	Adds clarifying comments for intentionally ignored JSON parse errors; removes unused local import / dead branches.
django_forms_workflows/utils.py	Replaces placeholder LDAP backend instantiation with clearer “available but not configured” logging.
django_forms_workflows/tasks.py	Documents intentionally ignored missing-task cases during notification rendering.
django_forms_workflows/static/django_forms_workflows/js/workflow-builder.js	Removes unused locals and explicitly exports WorkflowBuilder to window for admin bootstrap usage.
django_forms_workflows/static/django_forms_workflows/js/form-builder-property-editor.js	Removes unused dropdown-building code paths.
django_forms_workflows/migrations/0064_add_reviewer_groups.py	Removes unused import/whitespace in migration.
django_forms_workflows/handlers/file_handler.py	Replaces path-containing log messages with managed-file ID logs for file operations.
django_forms_workflows/forms.py	Removes unused imports/variables and simplifies approval-step field creation path.
django_forms_workflows/email_backends/gmail_api.py	Adds clarifying comment for intentionally ignored malformed Gmail error payloads.
django_forms_workflows/admin.py	Removes unused local imports where module-level json is already used.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.