ci: harden open-source release and repository checks

[ElliotSun]

Summary

• make releases explicitly manual via workflow_dispatch instead of publishing after every merge to main
• add lightweight Ruff static checks without imposing a broad formatting migration
• add CodeQL and dependency-review workflows
• add weekly Dependabot updates for Python and GitHub Actions dependencies
• add SECURITY.md and CONTRIBUTING.md
• add pull request and issue templates
• update package metadata to reflect SemaPact's current lifecycle-governance positioning and MIT license

Why

Merging development work should validate integration, not automatically create a new project version. The repository also lacked several baseline controls expected for a public Python project, particularly vulnerability reporting, dependency monitoring, static/security analysis, and contributor guidance.

Release flow after this change

1. merge changes normally and let CI/security checks validate them
2. when a release is desired, open Actions → Release → Run workflow
3. semantic-release calculates the version from commits since the previous tag and performs the existing tag/build/publish flow

Scope choices

• no coverage percentage gate
• no broad Ruff style migration; CI only enables high-confidence correctness rules (E9, F63, F7, F82)
• no Code of Conduct added in this change

Validation

New PR checks are triggered on this branch: CI, CodeQL, and Dependency Review.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.