Harden GitHub Actions workflows and upgrade actions to latest versions #5

Summary

Aikido Security on Packagist reports several CI/supply-chain hygiene issues for this package. This issue covers the ones we can fix in the repository.

Problems

• Unpinned actions: all 9 uses: references point to mutable tags (@v4, @v2, …) instead of commit SHAs.
• Template injection: in post-ci-build.yml, ${{ github.event.client_payload.sha }} is put directly into a run: script. Anyone who can send a repository_dispatch event could inject shell commands.
• No security scanning tooling: no Dependabot config, and dependencies aren't checked for known vulnerabilities.
• Outdated actions: three actions are several major versions behind:

Tasks

• Pin every action to a full commit SHA, with a version comment (@<sha> # vX.Y.Z)
• Fix the template injection in post-ci-build.yml: pass the payload SHA through env and check it's a 40-character hex SHA before using it
• Add top-level permissions: contents: read to ci.yml
• Set persist-credentials: false on all actions/checkout steps
• Add .github/dependabot.yml for github-actions and composer (weekly)
• Add a composer audit step to CI
• Upgrade checkout, upload-artifact and codecov-action to v7, after reviewing their changelogs for breaking changes
• Run zizmor on the workflows with no findin

Acceptance criteria

• CI passes on all PHP versions in the matrix (8.2–8.5)
• Coverage still uploads to Codecov
• The post-CI build still runs after a push to main and uploads the Composer archive
• zizmor .github/workflows reports no findings