Harden CI workflows before the repo goes public

[cubeorgdev]

What problem does this solve?

We're flipping this repo to public. A handful of workflow-level gaps only matter once outside contributors can open PRs against it:

• ci.yml and security.yml have no concurrency group (the e2e workflows do). Push-spam on a PR queues unbounded parallel Rust + Windows builds.
• Four uses: are still pinned to mutable tags: contributor-assistant/github-action@v2.6.1, actions/github-script@v7, and taiki-e/install-action@nextest twice. The CLA one is handed a repo-scoped PAT. Tag pins also block turning on the org "require actions pinned to a SHA" policy.
• docs.yml and release.yml have no top-level permissions:, so they inherit whatever the repo default happens to be rather than declaring read.
• The three security.yml scanner-report artifacts keep the default 90-day retention. Artifacts are world-downloadable on a public repo.
• There's no .github/dependabot.yml, so enabling Dependabot won't actually keep cargo / npm / action versions moving.

Proposed solution

One workflow-only PR covering all five: PR-scoped concurrency on the two workflows, SHA pins for the four actions, explicit permissions: contents: read on the two missing ones, retention-days: 1 on the scanner reports, and a dependabot.yml for cargo, the three npm apps, and github-actions.

Repository settings work — fork-PR approval, production environment protection, secret scanning, self-hosted runner scoping, required status checks — is separate and done in the GitHub UI, not here.

Before submitting

• I searched existing issues and this isn't a duplicate.
• I confirmed this doesn't already exist elsewhere in Blue.