Version 2.19.3

Pin CI, run it on Python 3.14, and fix the docs build

- .python-version: 3.8 -> 3.14. Build 4213 runs the "3.8" host on Python
  3.14 and 3.14 is now the documented value, so Sublime, Package Control
  and CI all read the same version
- Pin runners to ubuntu-24.04 and actions to full commit SHAs
- Pin everything CI installs in .github/constraints.txt, applied via
  PIP_CONSTRAINT
- Add Dependabot (monthly, grouped, 7-day cooldown) for actions and pip
- Least-privilege token (contents: read); checkout no longer persists
  credentials
- Pages write permissions only on the deploy job
- mkdocs: replace uslugify, removed in pymdown-extensions 12.0, with the
  equivalent slugify(case: lower)
- Node 22 -> 24 and pin jshint to 2.13.6