Add release workflow and port common patterns

[wagoodman]

• Switched to go-make: Replaced Makefile with go-make (Makefile now acts as a thin shim)
• Added binny for tool management: New .binny.yaml with 7-day cooldown for version updates
• Added release workflow: release.yaml using anchore/workflows for version checks, gating, and tag creation
• Added CodeQL workflow: codeql.yaml for security scanning of Go code and GitHub Actions
• Updated dependabot: Weekly schedule (Fridays), PR grouping for minor/patch updates, individual PRs for major and security updates
• Updated bootstrap action: Now caches .tool/ directory based on .binny.yaml hash

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.