chore: harden CI workflows and add Dependabot#11

decofe wants to merge 2 commits intomaintempoxyz/metrics-derive:mainfrom

georgen/ci-hardeningtempoxyz/metrics-derive:georgen/ci-hardeningCopy head branch name to clipboard