(chore) standard actions: ci, security scan, monthly dependabot

[w1ck3ds0d4]

• ci.yml gains workflow_dispatch, a ci-${{ github.ref }} concurrency group that only cancels in-progress PR runs, and the standard Dependabot auto-merge job
• security.yml (the dogfood caller of this repo's own scan.yml) gains workflow_dispatch
• dependabot.yml moved to monthly with patch and minor/major update groups for github-actions and npm
• Added a README note that private callers of the reusable scan.yml pay their own metered minutes, while this repo's dogfood run stays free since it is public
• No functional changes to scan.yml itself; tests still pass (node --test)