ci: add dependabot auto-merge and pin actions to SHAs

[timonviola]

Sets up automated Dependabot updates for this repo, following SneaksAndData/arcane-stream-sqlserver@17ef950.

Changes

• .github/dependabot.yml: uses the grouped github-actions config (7-day cooldown, ci commit prefix, dependencies/github_actions labels, separate groups for version and security updates).
• .github/workflows/dependabot-auto-merge.yaml (new): approves Dependabot PRs and enables auto-merge (squash). Major version bumps are excluded, except for GitHub Actions.
• Validate commit (build.yaml): the job gets id-token: write, pull-requests: write and contents: read, which Dependabot PRs need. The workflow now sets permissions: {} at the top.
• zizmor (zizmor --fix=all, plus manual fixes):
  • All actions are pinned to commit SHAs, with a version comment on each. The pinned versions are the ones already in use.
  • persist-credentials: false is set on every actions/checkout step.
  • release.yaml now has permissions: {} at workflow level, and create_release gets contents: write.
  • The pull_request_target trigger is marked as intentionally allowed with a zizmor ignore. The workflow never checks out PR code and only runs for dependabot[bot].

Verification

• zizmor . (online) reports no findings (1 ignored, 6 suppressed).
• actionlint reports no findings.

Dependencies

• SneaksAndData/terraform#8427 turns on the repository rulesets that let Dependabot bypass required reviews. The ruleset requires the Validate commit check.
• Auto-merge also requires allow_auto_merge = true on this repo, which is currently false.