ci: update GraalVM action and enable Dependabot (#4082)

## Why?

The [ASF allowlist
job](https://github.com/apache/fory/actions/runs/36290519259/job/108539571389)
fails because the three
`graalvm/setup-graalvm@6f3fa030c4b8f77c1f554a860f593a654538fa38`
references are no longer allowlisted.

## What does this PR do?

- Update all three GraalVM setup references to the ASF-approved v1.6.6
commit `0426e2e191540e8514dff98dc52a5f5146a2a276`.
- Add Dependabot for GitHub Actions, following
[apache/kvrocks#3612](apache/kvrocks#3612):
weekly grouped version updates, a four-day cooldown, separate
security-update grouping, and the `ci` commit prefix.

## Validation

- Run the exact ASF checker used by the failing job against a frozen
current allowlist: the baseline reproduces all three rejections; this
change passes with all 30 unique action references approved.
- Yamllint passes across all 46 YAML files, with existing
comment-spacing warnings only.
- Dependabot schema validation, Prettier checks for both changed files,
and `git diff --check` pass.
- Both fresh reviewers report no actionable findings. [Review results
and validation
evidence](https://gist.github.com/chaokunyang/65d9191831e5955390ed8d00530bed7d).

## AI Usage Disclosure

- substantial_ai_assistance: yes
- scope: CI diagnosis, configuration changes, local validation, and
review
- affected_files_or_subsystems: `.github/workflows/ci.yml` and
`.github/dependabot.yml`
- ai_review: assistant line-by-line self-review completed, followed by
fresh Fory-guided and independent general reviewers; both reported no
actionable findings on the final patch in
`1bf4b7ce380749785274f5154d9b46b22fa0ce74`
- ai_review_artifacts: [Fory-guided and independent review
results](https://gist.github.com/chaokunyang/65d9191831e5955390ed8d00530bed7d)
- human_verification: the checks above were executed and their results
reviewed by the assistant; human contributor verification is not
asserted by this automated record
- performance_verification: not applicable; CI configuration only
- provenance_license_confirmation: Dependabot configuration follows the
Apache-licensed Kvrocks reference and preserves its ASF license header;
no runtime or third-party code is introduced

## AI Contribution Checklist

- [x] Substantial AI assistance was used: yes.
- [x] Scope, affected files, validation, provenance, and review evidence
are disclosed above.
- [x] Assistant self-review completed before the two fresh reviews.
- [x] A fresh Fory-guided reviewer followed `AGENTS.md` and
`.agents/ci-and-pr.md`.
- [x] A separate fresh independent reviewer did not use the
Fory-specific review guide.
- [x] Both reviewers reported no further actionable comments on the
final patch; their results are linked above.
- [x] Relevant local checks passed and are recorded above.
- [x] No public API, binary protocol, runtime behavior, or performance
change requires additional runtime tests or benchmarks.
- [x] Apache-2.0-compatible configuration provenance and the required
license header are preserved.
- [ ] Human contributor has personally reviewed the patch and validation
results, can explain the change, and confirms submission accountability.

Author: chaokunyang

.github/dependabot.yml

@@ -0,0 +1,36 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    # Give ASF Infrastructure time to approve new action releases first.
+    cooldown:
+      default-days: 4
+    commit-message:
+      prefix: ci
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+      github-actions-security:
+        applies-to: security-updates
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -660,7 +660,7 @@ jobs:
         java-version: ["17", "25"]
     steps:
       - uses: actions/checkout@v5
-      - uses: graalvm/setup-graalvm@6f3fa030c4b8f77c1f554a860f593a654538fa38 # 1.5.6
+      - uses: graalvm/setup-graalvm@0426e2e191540e8514dff98dc52a5f5146a2a276 # v1.6.6
         with:
           java-version: ${{ matrix.java-version }}
           distribution: "graalvm"
@@ -687,7 +687,7 @@ jobs:
         java-version: ["17", "25"]
     steps:
       - uses: actions/checkout@v5
-      - uses: graalvm/setup-graalvm@6f3fa030c4b8f77c1f554a860f593a654538fa38 # 1.5.6
+      - uses: graalvm/setup-graalvm@0426e2e191540e8514dff98dc52a5f5146a2a276 # v1.6.6
         with:
           java-version: ${{ matrix.java-version }}
           distribution: "graalvm"
@@ -711,7 +711,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: graalvm/setup-graalvm@6f3fa030c4b8f77c1f554a860f593a654538fa38 # 1.5.6
+      - uses: graalvm/setup-graalvm@0426e2e191540e8514dff98dc52a5f5146a2a276 # v1.6.6
         with:
           java-version: "25"
           distribution: "graalvm"