ci: update GraalVM action and enable Dependabot

[chaokunyang]

Why?

The ASF allowlist job fails because the three graalvm/setup-graalvm@6f3fa030c4b8f77c1f554a860f593a654538fa38 references are no longer allowlisted.

What does this PR do?

• Update all three GraalVM setup references to the ASF-approved v1.6.6 commit 0426e2e191540e8514dff98dc52a5f5146a2a276.
• Add Dependabot for GitHub Actions, following apache/kvrocks#3612: weekly grouped version updates, a four-day cooldown, separate security-update grouping, and the ci commit prefix.

Validation

• Run the exact ASF checker used by the failing job against a frozen current allowlist: the baseline reproduces all three rejections; this change passes with all 30 unique action references approved.
• Yamllint passes across all 46 YAML files, with existing comment-spacing warnings only.
• Dependabot schema validation, Prettier checks for both changed files, and git diff --check pass.
• Both fresh reviewers report no actionable findings. Review results and validation evidence.

AI Usage Disclosure

• substantial_ai_assistance: yes
• scope: CI diagnosis, configuration changes, local validation, and review
• affected_files_or_subsystems: .github/workflows/ci.yml and .github/dependabot.yml
• ai_review: assistant line-by-line self-review completed, followed by fresh Fory-guided and independent general reviewers; both reported no actionable findings on the final patch in 1bf4b7ce380749785274f5154d9b46b22fa0ce74
• ai_review_artifacts: Fory-guided and independent review results
• human_verification: the checks above were executed and their results reviewed by the assistant; human contributor verification is not asserted by this automated record
• performance_verification: not applicable; CI configuration only
• provenance_license_confirmation: Dependabot configuration follows the Apache-licensed Kvrocks reference and preserves its ASF license header; no runtime or third-party code is introduced

AI Contribution Checklist

• Substantial AI assistance was used: yes.
• Scope, affected files, validation, provenance, and review evidence are disclosed above.
• Assistant self-review completed before the two fresh reviews.
• A fresh Fory-guided reviewer followed AGENTS.md and .agents/ci-and-pr.md.
• A separate fresh independent reviewer did not use the Fory-specific review guide.
• Both reviewers reported no further actionable comments on the final patch; their results are linked above.
• Relevant local checks passed and are recorded above.
• No public API, binary protocol, runtime behavior, or performance change requires additional runtime tests or benchmarks.
• Apache-2.0-compatible configuration provenance and the required license header are preserved.
• Human contributor has personally reviewed the patch and validation results, can explain the change, and confirms submission accountability.