feat(lab1): juice shop deploy + PR template + triage report

[mobgun]

Goal

Deploy OWASP Juice Shop v20.0.0 locally, write a triage report, and set up the PR template and CI smoke test used for all labs.

Changes

• submissions/lab1.md: triage report (asset, deployment, health, surface, headers, top 3 risks), PR template, GitHub community and CI smoke test sections
• .github/PULL_REQUEST_TEMPLATE.md: Goal / Changes / Testing / Artifacts & Screenshots sections and the three checklist items
• .github/workflows/lab1-smoke.yml: runs on pull_request to main with permissions: contents: read, starts bkimminich/juice-shop:v20.0.0 as a service container and polls /rest/admin/application-version with curl --silent --fail for up to 60 s

Testing

docker run -d --name juice-shop -p 127.0.0.1:3000:3000 bkimminich/juice-shop:v20.0.0
docker ps --filter name=juice-shop --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'
curl -s -o /dev/null -w "HTTP %{http_code}\n" http://127.0.0.1:3000
curl -s http://127.0.0.1:3000/rest/admin/application-version
python -c "import json,urllib.request; print(len(json.load(urllib.request.urlopen('http://127.0.0.1:3000/api/Products'))['data']))"
curl -sI http://127.0.0.1:3000 | head -20

juice-shop   Up 3 minutes   127.0.0.1:3000->3000/tcp
HTTP 200
{"version":"20.0.0"}
46
Missing security headers: Content-Security-Policy, Strict-Transport-Security

CI smoke test log:

not ready yet (1s), retrying...
{"version":"20.0.0"}
Juice Shop is up after 4s

Artifacts & Screenshots

• Triage report: submissions/lab1.md
• Image digest: bkimminich/juice-shop@sha256:fd58bdc9745416afce8184ee0666278a436574633ea7880365153a63bfd418b0
• Draft PR with the auto-filled template: feat(lab1): juice shop deploy + PR template + triage report mobgun/DevSecOps-Intro#1
• Green CI run (20 s): https://github.com/mobgun/DevSecOps-Intro/actions/runs/34598315606

Checklist

• PR title follows feat(labN): <topic>
• No secrets or large temp files committed
• submissions/labN.md exists