security: harden supply chain and add vulnerability reporting policy

Adds repo-level security hardening. All changes are additive — no
existing code is touched.

- .github/dependabot.yml: npm + github-actions ecosystems with
  cooldowns (3-day patch / 7-day minor / 21-day major) so brand-new
  releases have time to be flagged before we pull them in. Security
  advisories bypass cooldown automatically. npm scoped to
  /mcp/ponymail-mcp where package.json lives. Minor + patch updates
  grouped into single PRs.
- .github/workflows/codeql.yml: CodeQL on push / PR / weekly with
  the security-extended and security-and-quality query suites for
  JS/TS.
- .github/workflows/scorecard.yml: OpenSSF Scorecard; publishes
  results to code scanning + SARIF artifact.
- .github/workflows/dependency-review.yml: blocks PRs introducing
  deps with >=moderate CVEs or GPL/AGPL licenses.
- .github/workflows/zizmor.yml: static analysis of the workflows
  themselves (script injection, overbroad permissions, unpinned
  refs, cache poisoning, etc.).
- SECURITY.md: vulnerability reporting policy directing reporters
  to security@apache.org first, with GitHub PVR as a secondary
  channel for issues isolated to this repo's tooling.

Workflow hardening applied throughout:
- Top-level `permissions: {}` (deny-all) with per-job minimum grants.
- All third-party actions pinned to full commit SHAs (with version
  comments) — Dependabot keeps them current.
- actions/checkout sets persist-credentials: false so a stashed
  token can't be exfiltrated by later steps.
- Timeouts on every job.

Generated-by: Claude Code (Claude Opus 4.7)