Implement security fixes for identified vulnerabilities

[austenstone]

This pull request addresses several critical security vulnerabilities in the codebase, enhancing the overall security posture of the application.

• SQL Injection Mitigation: Updates model/auth.js and model/products.js to use parameterized queries instead of direct string concatenation, effectively mitigating SQL Injection vulnerabilities.
• CSRF Protection: Implements CSRF protection in app.js using express middleware, safeguarding the application against Cross-Site Request Forgery attacks.
• Secure Cookie Handling: Modifies session cookie settings in app.js to use secure attributes, including setting cookies as secure, httpOnly, and adjusting the maxAge for cookie expiration. This enhances session security and mitigates the risk of session hijacking.
• Sensitive Data Management: Changes the handling of application secrets in app.js to utilize environment variables instead of hardcoded values, minimizing the risk of sensitive data exposure.
• Security Policy Update: Revises the SECURITY.md file to provide clear guidelines for reporting vulnerabilities and supported versions, improving the project's security policy and vulnerability management process.

---

For more details, open the Copilot Workspace session.