chore(security): add dependency scanning and update automation

[CodeZeno]

Summary

• Add weekly Dependabot updates for Cargo dependencies and GitHub Actions.
• Add pinned cargo-audit and cargo-deny security checks for pull requests, pushes, schedules, and releases.
• Enforce locked release builds and document dependency security policies, exceptions, and local checks.

Testing

• cargo audit --file Cargo.lock
• cargo deny --locked check
• Release workflow updated to require dependency security checks before building.