build(deps): bump skrifa from 0.39.0 to 0.47.0 - #40

…re stale

The release row said "release commit on local `main`" because that was
true when it was written, an hour before the tag existed. Measured now:
`v0.61.0` = `3bec4fa`, `release-artifacts.yml` run 36033240012 green in
28m 8s — four targets, every one `verified`, and the assembly step's own
words are `one fingerprint on all 4 runners`, which is the condition
under which `SHA256SUMS.txt` gets written at all. CI #112 green on the
same commit.

The security row was overtaken by events on the day it was written. It
said secret scanning, push protection and org-wide 2FA "cannot be
changed from here" and were all off. Two of the three were turned on
the same day from the browser, on the owner's explicit grant, and the
`v0.61.0` push has now gone through push protection without a hit.
Org-wide 2FA stays off deliberately — enforcing it can lock out org
members who have not enrolled, which is the owner's to schedule, not a
thing to switch on while cutting a release. Private vulnerability
reporting is the one remaining switch with no side effect.

`dependabot.yml`, added this cycle in `6e97637`, has run: ten version
PRs, #35-#44. Two are recorded by name because they are not routine —
#43 bumps `lopdf`, whose version is a PROFILE FIELD (`backend.version`),
so merging it moves `profile_sha256` and is a reader change requiring
its own measurement; #40 jumps `skrifa` eight minors across the font
metrics `advance-over-font-envelope-v1` is built on. Neither is an
auto-merge, and saying so here is cheaper than finding out in a gate.

No code changed. Every number is read from the run or the settings page,
not inferred from a green tick.

Signed-off-by: docushell-dev <[email protected]>