Repo hygiene: templates, Dependabot, and security policy

[blindzero]

Summary

Implements repo hygiene improvements:

• Adds Dependabot configuration for GitHub Actions (weekly, grouped, PR limit).
• Adds root SECURITY.md (GitHub security policy entry point).
• Extends docs/advanced/security.md with repository security hygiene checklist and verification steps.

Motivation

Reduce maintainer overhead and keep repository hygiene consistent by standardizing contributor inputs and automating routine dependency updates.

Changes

• .github/dependabot.yml
• SECURITY.md
• docs/advanced/security.md

Verification

• No runtime/engine changes.
• CI should validate YAML and docs formatting where applicable.
• After merge: verify in GitHub UI that Dependabot is enabled and begins creating update PRs.

Issue

Closes #15