ci: 👷 Harden repository security automation - #89

Why

Gradle dependencies were not covered by the existing Actions-only Dependabot configuration, and no workflow submitted the resolved dependency graph for vulnerability alerts. Dependabot security PRs targeting the default branch were also rejected by the CI route check.

Changes

• Add weekly grouped Gradle version updates targeting develop.
• Submit resolved Gradle dependencies from trusted master pushes, a weekly schedule, or manual dispatch on master, using pinned actions and job-scoped write permissions.
• Allow Dependabot security PRs into master through the existing CI route check.
• Document the configured repository protections, single-maintainer review policy, and release-please CI approval procedure in the security and release guides.

Validation

• Hosted Linux CI passed on b406006dee9de1dccd0cb4fa87ca82cacde26c20: 289 tests passed, zero failures/errors/skips. Line coverage 95.35%; branch coverage 81.08%; both thresholds passed.
• Windows package checks were intentionally skipped for the develop target, matching existing CI policy. GitGuardian security checks and the test-summary job passed.
• actionlint 1.7.12: all three workflows passed. Dependabot YAML parsed successfully.
• Executed the actual PR route-check block: seven supported routes accepted and three unsupported routes rejected. git diff --check passed.
• Separately enabled and verified Secret scanning, push protection, Dependabot alerts/security updates, PR/CI branch requirements, and selected Actions with SHA pinning. CodeQL default setup completed successfully for Actions, C/C++, and Java/Kotlin on the base commit.

Compatibility and risks

No CLI, output, capture-format, or supported-Collector changes. Gradle submission becomes operational after this workflow reaches master; a successful submission has not yet been observed. The vendored Scouter JAR still needs separate review. Initial CodeQL analysis reported 39 findings under test/verification sources; those findings remain open and require separate triage. Optional real-Collector smoke tests were not run.