ci: enforce repository supply chain policy

[kev1n77]

Summary

• pin every third-party GitHub Action to an immutable commit SHA and add dependency review to CI
• add CODEOWNERS, Dependabot coverage, a security reporting policy, and deterministic repository supply-chain checks
• require exact direct dependency versions and update security/progress documentation

Verification

• python scripts/verify_supply_chain.py
• python -m unittest discover -s scripts/tests -v
• npm run desktop:check (45 tests)
• npm run desktop:build
• python -m unittest discover -s sidecars/mitmproxy/tests -v (27 tests, 2 skipped on Windows)
• cargo fmt --all -- --check
• cargo fmt --manifest-path apps/desktop/src-tauri/Cargo.toml -- --check