Version 1.3.14

Pin CI and run it on Python 3.14

- .python-version: 3.8 -> 3.14. Build 4213 runs the "3.8" host on Python
  3.14 and 3.14 is now the documented value, so Sublime, Package Control
  and CI all read the same version
- Pin runners to ubuntu-24.04 and actions to full commit SHAs
- Pin everything CI installs in .github/constraints.txt, applied via
  PIP_CONSTRAINT
- Add Dependabot (monthly, grouped, 7-day cooldown) for actions and pip
- Least-privilege token (contents: read); checkout no longer persists
  credentials