chore: Apply security best practices from StepSecurity

[mirzak]

No description provided.

[Copilot]

Pull Request Overview

This PR implements security best practices recommended by StepSecurity for GitHub Actions workflows. The changes harden workflow runners by auditing outbound calls and pin action versions to specific commit SHAs to prevent supply chain attacks.

• Adds the step-security/harden-runner action to all workflows with audit egress policy
• Pins all GitHub Actions to specific commit SHAs instead of using version tags
• Introduces new security-focused workflows for dependency review and CodeQL analysis
• Configures Dependabot to keep GitHub Actions dependencies up to date

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/scorecard.yaml	Added harden-runner step and pinned codeql-action to commit SHA
.github/workflows/pytest.yml	Added harden-runner step and pinned all actions to commit SHAs
.github/workflows/dependency-review.yml	New workflow to scan dependencies for known vulnerabilities in PRs
.github/workflows/conventional-commit.yml	Added harden-runner step and pinned actions to commit SHAs
.github/workflows/codeql.yml	New workflow for CodeQL security scanning on Python code
.github/dependabot.yml	New configuration to enable daily Dependabot updates for GitHub Actions

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}