Add supply chain hardening

[decofe]

Summary

• add Dependabot updates for Cargo and GitHub Actions with 7-day cooldown windows
• add a cargo-deny policy for advisories, bans, licenses, and sources, plus a required CI check
• pin GitHub Actions and the reusable dependency workflow to SHAs where used in this repo
• set read-only workflow permissions and disable checkout credential persistence where not needed
• verify the downloaded LLVM installer script by SHA-256 before execution

Prompted by: @grandizzy

Testing

• RUSTC_WRAPPER= cargo deny check advisories bans licenses sources
• pinact run --check --min-age 7
• bash -n .github/scripts/install_llvm_ubuntu.sh
• git diff --check

[codspeed-hq]

Merging this PR will not alter performance

✅ 71 untouched benchmarks

---

_{Comparing centaur/supply-chain-hardening-20260625145338 (827a376) with main (b5b60c1)}