fix(ci): restore scorecard and stop dependency PR spam

[yiaany]

Summary

• replace the rejected OpenSSF Scorecard action SHA with the verified upstream commit
• remove scheduled Dependabot version updates
• keep vulnerability alerts enabled while disabling automatic security-fix PRs

Verification

• npm run lint
• npm run typecheck
• npm test (343 passed)
• npm run build
• npm --prefix compat/sdk ci
• npm --prefix compat/sdk test

[github-actions]

GhostAPI PR safety

Result: success

The status check and sanitized evidence artifact are the source of truth. This comment is updated in place and contains no request traffic or secrets.