ci: standardize srtla workflows (concurrency, perms, ccache, latest actions) + Dependabot

[andrescera]

What

• Add concurrency to build-check, static-analysis, bindings (cancel:true) and publish-release (cancel:false)
• Add explicit permissions: contents: read to 4 workflows (publish keeps contents: write)
• Add ccache to CMake builds in build-check + static-analysis (actions/cache for ~/.ccache, CMAKE_*_COMPILER_LAUNCHER=ccache)
• Pin all uses: to resolved-latest major across all 5 workflows
• compat-matrix.yml: action pins only (concurrency + permissions already present — untouched)
• srtla/.github/actions/compat-build/action.yml: UNTOUCHED (byte-identical)
• Add .github/dependabot.yml (npm bindings + github-actions, weekly)

Why

Part of the cicd-standardization effort. Root policy PR (#25) merged first.

Risks

Low — CI config only. compat-build composite untouched. Receiver-only .deb packaging untouched.