Harden the release and site workflows, add a security policy, and update dependencies with security fixes - #26

- A release runs only for a pushed v* tag (only admins can push them). The
  release: published trigger is gone, so a release no longer publishes twice.
- Publishing moves to its own jobs in the release environment, which needs an
  approval and gets the built gem and the provider changes as artifacts: no
  job that has a credential runs the repository's code or restores a cache.
- The gem is pushed with a short-lived key from RubyGems trusted publishing
  (OIDC) instead of the long-lived RUBYGEMS_API_KEY secret.
- The provider repository is public, so it's cloned without a token. The
  token is passed to the two pushes only, not stored in the clone's config.

The supported versions page throws for a gemspec dependency it has no
description for, so the site stopped building when the gemspec listed
actionpack, activesupport, globalid and railties instead of rails. CI's docs
job only type-checks and runs the tests, so nothing caught it.

The descriptions move to docs/lib/gem-descriptions.ts with a test that every
gemspec dependency has one, and a new CI job builds the site the way the
deploy does, with the run's coverage report and YARD docs.

The deploy downloaded coverage-ruby-rails-latest from the newest successful CI
run of any branch, forks included (dawidd6/action-download-artifact v3, whose
allow_forks defaults to true, GHSA-5xr6-xhww-33m4), and served it under
logstruct.com/coverage/. A fork's pull request could upload its own HTML under
that name.

CI now calls the deploy as its last job on a push to main, and the deploy
downloads that run's artifact and checks out that run's commit. A manual
deployment uses the latest successful CI run of a push to main, which a pull
request's run never is. Only the deploy job can write to Pages.

The Playwright static server listened on every interface and served any file
the request path reached with ../ (encoded or not) or through a symlink. It now
binds 127.0.0.1, resolves each path inside out/ and answers 404 otherwise.

The home page test expected the old heading.

SECURITY.md asks for private reports through GitHub's vulnerability reporting.
Dependabot checks the gems, both pnpm projects and the workflow actions weekly,
with minor and patch updates grouped into one pull request each.

Relaxes the rails pin to 8.0.5 and updates only the gems with open Dependabot
alerts (rack, nokogiri, the Rails gems, loofah, rails-html-sanitizer, json,
net-imap, mail and others), regenerating their RBIs.

The concurrent-ruby <= 1.3.4 pin was only for Rails 7.0, whose test app pins
it itself, so it goes. json stays below 3: ActiveSupport 8.0 passes
quirks_mode, which json 3 rejects. net-imap stays on 0.5.x, and two of its
classes' new parents are allowed in sorbet/config.

Next 15.5.27, react-syntax-highlighter 16 (prismjs 1.30) and sharp 0.35, plus
pnpm update within each range. Removes packages nothing imports: gray-matter,
next-mdx-remote, remark, remark-html, rehype-highlight, rehype-pretty-code,
shiki, copy-to-clipboard and framer-motion, and the optional Linux binaries
pinned to latest for npm (pnpm installs the matching ones itself; checked
with a linux/amd64 install and build).

Biome 2.5 sorts export lists and flags an index key and a missed optional
chain. Jest 30.5 exits 0 without running tests when watchman is broken, so
the tests don't use it.

jscpd stays on 4.0.7: 4.3 needs Node 22.12 or later.

Dir[] picked up any untracked file under lib/ in a local build. The gem now
takes the same patterns from git ls-files, and uses Dir only without git.

Gives a compromised release time to be noticed and pulled first. Security
updates aren't delayed.

Next 15.5 pins postcss 8.4.31, which has open advisories (they need
attacker-controlled CSS or source maps; the site builds only its own CSS).
Next 16 moved to 8.5.