ci: harden supply chain across all workflows

[decofe]

Pin GH Actions to SHA, fix template injections, add least-privilege permissions, and upgrade vulnerable deps.

• Pin all actions to SHA across 26 workflows (via pinact)
• Fix template injections in bench-scheduled, bench, check-alloy, docker-tag-latest, docker-test, docker, release-reproducible, release, pr-audit
• Add permissions: contents: read to 15 workflows missing it
• Add persist-credentials: false to all checkout steps
• Replace curl|sh uv install with pinned astral-sh/setup-uv action
• Add 7-day cooldown to Dependabot config
• Pin Dockerfile runtime base to ubuntu:24.04
• Upgrade docs/vocs: hono 4.8.5→4.12.14, @hono/node-server→1.19.14, glob→11.1.0

Prompted by: georgen