ci: complete batch 02 security and compatibility controls

[jmanico]

Completes batch 02 from #169. CI now pins every action to a reviewed release SHA, guards development/release versions, and uses isolated Maven repositories. Two fail-closed gates preserve the browser, all ten ESAPI versions, Java 8 unit tests, source parity and packaged consumers on Java 8/11/17/21/25. Advanced CodeQL covers Java (including the optional Jakarta app), Actions and Python. Weekly grouped Dependabot updates and trusted-main submissions expose resolved runtime/test and build-plugin dependency graphs.

Repository controls are enabled and read back: read-only default tokens, no Actions PR approvals, all-external-contributor run approval, secret scanning/push protection, Pages HTTPS, inactive obsolete webhooks, immutable tags, an exact action allowlist and full-SHA enforcement. Main requires both CI gates and all three CodeQL jobs in a no-bypass ruleset. Review rules retain one approval, stale dismissal and latest-push approval; only Jim Manico and Jeremy Long have audit-visible PR-only emergency review bypass. This bypass does not bypass checks or constitute independent review. CODEOWNERS validation remains with #127.

Validation: actionlint 1.7.12; 10 policy/parser tests; fresh-repository JDK 17 clean verify (2,118 unit + eight integration tests); Java 17 packaged consumers and 11 artifact guard tests; optional Jakarta package/graph resolution without install and exact reactor JAR bytes in the WAR. All 26 checks passed on the implementation head, with zero CodeQL findings; the final documentation head is being checked again. Live probes rejected mutable action tags, unlisted pinned actions, tag update/deletion, and direct branch updates without PR/checks. Original tags remain unchanged. Full evidence and recovery instructions are in releases/batch-02-validation.md and .github/CI_SECURITY.md.

Closes #102. Closes #109. Closes #97. Closes #119. Closes #108.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.