Repository settings: Dependabot security updates are off, and content reports are off (the community profile reads 87%) #971

Two repository settings are off, and one of them is the only lever that moves the community profile from 87% to 100%.

• Dependabot security updates: disabled. .github/dependabot.yml (chore: add community-health files for contributor intake #964) configures version updates, which is a different feature. With security updates off, a dependency advisory does not open a pull request by itself; the project relies on tools/check_pip_audit.py and the nightly CVE job to notice, and on a human to act. Turning this on makes the advisory itself the trigger. It is the setting that turns "a known advisory is visible" into "a fix is proposed".
• Content reports: content_reports_enabled: false. Decide whether the repository accepts abuse reports through GitHub. This is the single remaining item in GitHub's community-profile checklist, so it is also what stands between 87% and 100%.

Neither is a code change; both are settings on the repository, which is why they are recorded here rather than carried in a pull request.

Acceptance criteria

• Dependabot security updates are enabled, or the issue records why a CVE would be handled by hand instead.
• The content-report decision is made, and if it is "no", this issue is closed with that reason rather than left open.
• Whichever way each goes, docs/reference/supply_chain_security.md describes the resulting pipeline accurately.