ci: pin actions to commit SHAs and add Dependabot - #18

SECURITY.md says each release ships a CycloneDX SBOM. It did — as a workflow
artifact, which expires after 90 days, and nuget.org has no slot for one. The
releases for v5.0.0 through v5.0.3 carry no assets, so the statement was true
for one quarter per release and then quietly false.

A third job, `release`, now runs after `publish`: it creates the GitHub
release if none exists (notes taken from the README's "What changed in
<version>" section, which ChangelogConsistencyTests already requires for the
shipped version — an empty extraction fails the job rather than publishing a
blank release) and attaches the per-package `.cdx.json` files. A release
created by hand before the tag is pushed is left as written; only the assets
are added. It runs after the push so what is attached describes what is on
nuget.org, and a failure here costs nothing but a manual upload.

Only the SBOMs are attached, deliberately. nuget.org repository-signs every
package on ingestion, so a .nupkg downloaded from there never matches ours
byte-for-byte; attaching ours would invite a hash comparison that fails for
a benign reason, and nuget.org is already the immutable store for the
packages. The SBOM has no other home.

The job holds contents: write and no id-token; publish holds id-token: write
and contents: read. No job holds both.

Verified: actionlint clean; the two run blocks executed locally, extracted
verbatim from the YAML, with `gh release create/upload` stubbed and `gh
release view` live — existing release (v5.0.3) leaves notes alone and exits 0,
missing release creates with the extracted section, a view failure that is
not "release not found" (401) fails loudly instead of attempting a create,
a version with no README section fails, a prerelease version gets
--prerelease, and a missing SBOM glob fails. The extraction was checked
against every shipped version's section. Not exercised: an actual tag push —
the first real run is the next release.

Co-Authored-By: Claude Fable 5 <[email protected]>