[codex] Improve remaining Scorecard drivers

[andrewkoltsov]

Summary

• add GitHub Actions Dependabot updates for pinned workflow SHAs
• add deterministic fast-check property coverage for CSRF parsing, endpoint building, and timeout env parsing
• fix annotated-tag action pins so Scorecard publish_results works again
• keep the changelog aligned with the repository security hardening work

Why

The merged workflow-hardening PR improved the Scorecard configuration surface, but the live Scorecard workflow exposed one follow-up issue: ossf/scorecard-action had been pinned to an annotated tag object SHA instead of the underlying commit SHA accepted by Scorecard workflow verification. This PR fixes that, adds the planned GitHub Actions update maintenance, and adds detectable fuzz/property-test coverage for the main parsing helpers.

Validation

• npm run lint
• npm run build
• npm run test:coverage
• npm run pack:check
• npx prettier --check .github/workflows/ci.yml .github/workflows/codeql.yml .github/workflows/scorecard.yml .github/dependabot.yml CHANGELOG.md test/scorecard-property.test.ts package.json package-lock.json

Notes

• Repository rules for master were created directly on GitHub and classic branch protection was removed, so Scorecard can read branch policy without the previous token-visibility error.
• The manual Scorecard run on master after PR [codex] Harden Scorecard workflow integration #45 reached a computed score of 7.0, but publication failed because of the annotated-tag pin for ossf/scorecard-action. This PR fixes that publication issue.
• Full local npm run validate in this checkout is still affected by the unrelated untracked .tasks/README.md formatting issue in the working tree, so the validation here used the repo’s individual gates instead.