ci: harden tooling and add security scanning

[dkulyk]

CI downloaded an unversioned type checker on every run, third-party Actions followed mutable tags, and the repository had no security policy or static security workflow.

Pin Bun and Deno setup Actions to verified commit SHAs. Official GitHub Actions remain on version tags as requested. Restrict ordinary CI to contents: read, disable persisted checkout credentials, use the lockfile-installed type checker and Jest, and skip lifecycle scripts when installing the locally built test archive.

Add CodeQL scans for JavaScript/TypeScript and Actions on PRs, main pushes and weekly; only analysis jobs receive security-events: write. Add weekly Dependabot updates for npm and Actions. Publish a private-reporting security policy and document the tooling. The policy is included in future npm archives so its README link works in the installed package.

Validation:

• Build and Biome pass; 505 tests pass on Node and actual Bun.
• Locked @arethetypeswrong/cli@0.18.5 reports no package/type-resolution issues.
• ESM/Node/Web/record-manager smoke passes; workflow and Dependabot YAML parse successfully.
• npm reports zero known vulnerabilities in the installed dependency tree.
• CI passes on Node 22/24, Bun and Deno. CodeQL analysis passes for both JavaScript/TypeScript and Actions.

No parser behavior, release version or existing release archive changed.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.