chore: migrate deprecated GitHub Actions and pin to SHA

[storytel-review-bot]

Summary

• Replace deprecated tokorom/action-slack-incoming-webhook with slackapi/slack-github-action
• Pin all third-party GitHub Actions to full commit SHA at latest mature version (≥ 21 days old)
• Create dependabot config for github-actions with 21-day cooldown

Actions Replaced

Old Action	Replacement
tokorom/action-slack-incoming-webhook@main (2 steps)	slackapi/slack-github-action@v2.1.1 — moved INCOMING_WEBHOOK_URL to SLACK_WEBHOOK_URL env, added SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK, restructured text/blocks inputs into single payload JSON

Actions Pinned/Updated

Action	Old Version	New Version
actions/checkout	v3 / v4 (unpinned)	de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
stefanzweifel/git-auto-commit-action	v4 (unpinned)	04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
skiptools/swift-android-action	v2 (unpinned)	2f0d783249992c34b120d33d1e12e261aa753419 # v2.8.2

⚠️ Major Version Upgrades

• actions/checkout v3/v4 → v6
• stefanzweifel/git-auto-commit-action v4 → v7

Slack Action Migration Notes

The tokorom/action-slack-incoming-webhook action took text and blocks as separate with: inputs. The replacement slackapi/slack-github-action uses a single payload JSON input containing both. The ${{ toJSON(github.event.release.body) }} expression is preserved and produces valid JSON inline.

Dependabot

• Created new dependabot.yml with github-actions ecosystem and 21-day cooldown

Context

• Ref: RFC-318
• Format: uses: owner/action@<sha> # vX.Y.Z

🤖 Generated with Claude Code