Configure dependency and security monitoring

[erseco]

Summary

This PR configures automated dependency and security monitoring for the maintenance fork using GitHub's native Dependabot and CodeQL features. No automatic merges are enabled; all updates require CI validation and human review.

• Dependabot version updates: Enabled for npm and GitHub Actions, weekly schedule
• No PR limits: Intentionally uncapped to catch all updates
• Major version updates: Not globally suppressed — major updates are normal maintenance
• No automatic merging: All PRs require human review and CI validation
• Dependabot security updates: Will be enabled to detect and report vulnerable dependencies
• CodeQL scanning: To be enabled via GitHub Default setup for JavaScript analysis
• Secret scanning & push protection: To be enabled for additional security layers
• Repository changes only: No changes to application runtime or build output

The Dependabot configuration targets main for all updates, keeping master as a clean fast-forward mirror of drichard/mindmaps:master.

Validation

• npm ecosystem targets / with weekly schedule
• github-actions ecosystem targets / with weekly schedule
• Both update to main branch
• No open-pull-requests-limit configured
• No automatic merging enabled
• No dependency grouping or global major-version ignores
• Existing CI workflow unchanged

This is maintenance infrastructure only; no runtime dependencies are modified.