fix: address zizmor security findings

[Daniel-Aaron-Bloom]

Summary

This PR addresses zizmor security findings in the GitHub Actions workflow files.

Findings Fixed

• dependabot-cooldown (.github/dependabot.yml): Added cooldown configuration (semver-patch: 3, semver-minor: 7, semver-major: 14 days) to the npm ecosystem entry.

• dangerous-triggers (.github/workflows/dependabot-overrides.yml): Changed pull_request_target to pull_request to eliminate the fundamentally insecure workflow trigger. pull_request_target grants write access while running untrusted PR code; pull_request is safe for dependabot PRs (same-repo branches).

• bot-conditions (.github/workflows/dependabot-overrides.yml): Changed github.actor to github.triggering_actor in the job condition to prevent actor spoofing.

• unpinned-uses (.github/workflows/dependabot-overrides.yml): Pinned actions/checkout@v4 to full commit SHA actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2.

• artipacked (.github/workflows/dependabot-overrides.yml): Added persist-credentials: false to the checkout step; git push now uses an explicit token via environment variable instead of stored credentials.

• unpinned-uses (.github/workflows/sdk-type-check.yml): Pinned the reusable workflow wormhole-foundation/workflows/.github/workflows/wormhole-demo-typecheck.yml to commit SHA 30ad77bad7253e603b820f3037045fa0590e4151.

• secrets-inherit (.github/workflows/sdk-type-check.yml): Removed secrets: inherit to stop unconditional secret propagation to the called workflow.

Test plan

• Verify dependabot-overrides.yml still triggers correctly on dependabot PRs updating package.json
• Verify sdk-type-check.yml type-check job runs successfully
• Confirm zizmor CI passes on this PR

🤖 Generated with Claude Code

[djb15]

Pinned to the version before the zizmor fixes