fix(ci): GitHub Actions security hardening

[stevebeattie]

This PR applies a set of GitHub Actions hardening fixes to the workflows in
.github/workflows/, surfaced by static analysis (zizmor / actionlint).

What this changes

• persist-credentials: false on checkout steps (documentation.yml,
  main.yml). Neither job pushes back to the repo, so the auto-persisted
  GITHUB_TOKEN is unnecessary; leaving it in the local git config widens the
  blast radius of any later step. Explicitly opting out drops the credential
  from .git/config.
• Least-privilege permissions on the docs workflow (documentation.yml).
  Adds a top-level permissions: {} (deny-all default) and grants the docs
  job only contents: read, which is all it needs to clone and render docs.
• Corrected version comment on hashicorp/setup-terraform (main.yml).
  The pinned SHA's trailing comment read # 3.0.0; aligned it to the tag form
  # v3.0.0 so the pin and its human-readable annotation agree.
• Repo-level zizmor config (.github/zizmor.yml). Adds a small config that
  disables three pedantic, cosmetic-only rules (anonymous-definition,
  undocumented-permissions, concurrency-limits) so future scans stay focused
  on substantive findings. The existing zizmor.yaml workflow's paths: trigger
  is extended to include this new file so config changes re-run the scan.
• Dependabot coverage (.github/dependabot.yml). The workflows pin every
  external action to a commit SHA, but the repo had no dependabot config, so the
  pins had no automated freshness mechanism and were being bumped by hand. Adds
  weekly github-actions and terraform update coverage with a 3-day cooldown.
  The matching dependabot-cooldown threshold is declared in .github/zizmor.yml.

Test plan

• zizmor .github/ — clean after these changes (the cosmetic rules above are
  suppressed via the committed config).
• actionlint — workflows still parse with no errors.
• terraform fmt -check / validate behavior is unchanged (only checkout and
  permissions metadata were touched, not the lint steps).

An independent review of the change set found no blocking issues.

Refs: PSEC-923