ci(SDKE-1128): migrate Core Web SDK to trunk-based development

[alexs-mparticle]

Replace Gitflow branch model (development/master/staging-step-1/2/3) with trunk-based development using main as trunk and an auto-updated staging branch for E2E testing and releases.

• Add release-step-1.yml: automatic staging pipeline on push to main
• Add release-step-2.yml: manual release order push for CDN
• Add release-step-3.yml: semantic-release from staging, publish to NPM/CDN
• Remove staging-step-1/2/3.yml (replaced by new pipeline)
• Update pull-request.yml to compare bundle size against main (not master)
• Remove pr-branch-target-gitflow check from reusable-workflows.yml
• Point dependabot and security checks at main
• Point release.config.js branches at staging

NOTE: After merging, the following branches should be deleted:

• development
• master (replaced by main)
• release-order-a/b/c (managed via release-step-2 workflow)

mPServer must be updated to reference main instead of master for the Core Web SDK GitHub repo (see linked Jira ticket).

Background

• {Explain the context of the change, including the problem it addresses or relevant background information}

What Has Changed

• {Describe the changes introduced by this PR}

Screenshots/Video

• {Include any screenshots or video demonstrating the new feature or fix, if applicable}

Checklist

• I have performed a self-review of my own code.
• I have made corresponding changes to the documentation.
• I have added tests that prove my fix is effective or that my feature works.
• I have tested this locally.

Additional Notes

• {Any additional information or context relevant to this PR}

Reference Issue (For employees only. Ignore if you are an outside contributor)

• Closes https://go/j/[ticket-number]

[sonarqubecloud]

Quality Gate failed

Failed conditions
8 Security Hotspots

See analysis details on SonarQube Cloud