chore(security): add Dependabot cooldown/groups and hash-pin release pip installs

[Copilot]

This updates dependency hygiene controls for the repository by (1) adding Dependabot cooldown/grouping behavior per ecosystem and (2) removing ad-hoc pip installs from release automation in favor of hash-verified requirements.

• Dependabot policy hardening (.github/dependabot.yml)

  • Added cooldown.default-days: 3 to each updates entry.
  • Kept existing Cargo grouping intact.
  • Added explicit grouping for GitHub Actions updates with a single wildcard actions group.

• Deterministic pip install in release workflow (.github/workflows/release.yml)

  • Replaced direct package install with hash-enforced install from a pinned lock file:

    pip install -r requirements.txt --require-hashes > /dev/null

• Pinned Python dependency lock (requirements.txt)

  • Added a hash-pinned requirements file generated via uv pip compile --generate-hashes for the workflow’s Python dependency set (including yq and transitive dependencies).

[Copilot]

Pull request overview

This PR tightens dependency management for the repository by hardening Dependabot behavior (cooldown + grouping) and making the release workflow’s Python tooling install deterministic via hash-pinned requirements.

Changes:

• Added Dependabot cooldown configuration per ecosystem and grouped GitHub Actions updates into a single wildcard group.
• Updated the release workflow to install yq (and its deps) from a hash-verified requirements.txt instead of ad-hoc pip install yq.
• Introduced a new hash-pinned requirements.txt lockfile for the workflow’s Python dependencies.

Show a summary per file

File	Description
requirements.txt	Adds a hash-pinned Python dependency lockfile intended for deterministic installs.
.github/workflows/release.yml	Switches release-version parsing dependency install to pip install -r requirements.txt --require-hashes.
.github/dependabot.yml	Adds cooldown settings and groups GitHub Actions updates under a single group.

Copilot's findings

• Files reviewed: 2/3 changed files
• Comments generated: 1