This is a basic security policy, mostly to provide an email address. I
took inspiration from the example provided by GitHub and the policy from
the Pallets project.

Fixes warnings like at the bottom right of
https://github.com/theskumar/python-dotenv/actions/runs/7980672386

* https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot
* https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem

* Fix multiline string in test.yml

* strategy: fail-fast: false

* Update test.yml

closes #457

…and signal handling (#523)

The current implementation of `dotenv run` CLI uses `subprocess.Popen`, which spawns a child process to execute the specified command. 

```
p = Popen(command,
              universal_newlines=True,
              bufsize=0,
              shell=False,
              env=cmd_env)
```

After spawning the child process, it exits with the same exit code returned by the child process.

```
ret = run_command(commandline, dotenv_as_dict)
exit(ret)
```

### We can enhance `dotenv run` usage dramatically while preserving exactly the same behaviour

By switching to `os.execvpe` instead of `subprocess.Popen`, we can replace the parent dotenv process with the new process specified by the user. This results in only one active process—the program the user intended to run.

**Benefits:**

1. No hanging parent process
    `dotenv run` acts as a launcher, so after executing `dotenv run redis-server`, only the Redis server process remains. The dotenv process, along with its Python interpreter, is completely replaced. This prevents the dotenv process from consuming RAM and other resources, which would otherwise persist until the Redis server exits.

2. Proper signal handling
    When using `subprocess.Popen`, the parent process (e.g., `dotenv`) remains responsible for handling and forwarding signals, which can lead to issues if the command doesn’t receive them directly. For instance, in Docker, if Redis was started without `exec`, it may not get important signals like `SIGTERM` when the container stops, potentially resulting in improper shutdowns or zombie processes. Using `os.execvpe` ensures that the command receives signals directly, improving reliability and making `dotenv` more suitable for production environments and improving reliability for DevOps engineers managing containerized applications.
    
All current logic will be preserved because dotenv run does not do anything special except propagate the child process exit code.

Thanks / @eekstunt

* ci: add py3.13 to test.yml

* Improve type hints

* fix typo

Bumps the github-actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [actions/setup-python](https://github.com/actions/setup-python).


Updates `actions/checkout` from 2 to 4
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v2...v4)

Updates `actions/setup-python` from 2 to 5
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v2...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

fixes #550

This commit uses the name `python-dotenv` instead of `Python-dotenv` in the README.md file