fix: pin GitHub Actions to commit SHA, add dependabot config

[jeffersongoncalves]

Summary

• Pins all 14 third-party Actions in ci.yml, benchmark-comment.yml, and benchmark-on-demand.yml to full commit SHA instead of tag refs
• Adds .github/dependabot.yml (composer + github-actions, weekly, grouped, 7-day cooldown)

Why

Tag/branch refs can be re-pointed by a compromised maintainer to exfiltrate CI secrets or inject malicious code — as happened with tj-actions/changed-files in March 2025. Pinning to SHA guarantees the code that ran yesterday runs again today. Dependabot cooldown gives a window to catch a malicious release before it auto-lands as a PR (ref: xz-utils incident).

Test plan

• Verified all 14 uses: refs resolve to the correct SHA for their tag
• Re-ran dependency audit locally — 0 critical, 0 warnings after fix

[github-actions]

Benchmark Result: Default

Attempt	Blade	Blaze	Change
#1	198.78ms	10.82ms	94.6%
#2	198.89ms	10.88ms	94.5%
#3	200.71ms	10.86ms	94.6%
#4	198.07ms	10.81ms	94.5%
#5	197.36ms	10.82ms	94.5%
#6	199.15ms	10.81ms	94.6%
#7	198.70ms	10.83ms	94.5%
#8	198.19ms	10.85ms	94.5%
#9	199.54ms	10.88ms	94.5%
#10 *	201.98ms	10.94ms	94.6%
Snapshot	197.43ms	10.81ms	94.5%
Result	198.78ms (~)	10.83ms (~)	94.6% (~)

_{Median of 10 attempts (* = outlier, excluded from result), 5000 iterations x 10 rounds, 27.23s total}

_{To run a specific benchmark, comment /benchmark <name>
attributes, aware, class, default, forwarding, merge, named-slots, no-attributes, slot, compilation}