Improve Plumb package score

[CodeWithDennis]

Summary

This PR addresses the negative Plumb findings for codewithdennis/larament by tightening supply-chain security, adding repository security metadata, improving dependency automation, and cleaning the published Composer archive.

The current Plumb report showed the main score impact in the Security category, with additional lower-impact findings in package archive hygiene and Symfony ecosystem compatibility. This PR focuses on mechanically verifiable changes that Plumb can detect on the next release scan.

What changed

• Pinned all third-party GitHub Actions to full commit SHAs while keeping comments with the original tag for maintainability.
• Added .github/dependabot.yml with Composer, npm, and GitHub Actions enabled, plus a 7-day cooldown for version updates.
• Added SECURITY.md that directs vulnerability reports to GitHub private vulnerability reporting instead of public issues.
• Expanded .gitattributes export-ignore rules so release archives exclude CI files, local/dev tooling, generated cache/log files, test files, vendored dependencies, node_modules, local database files, and private environment files.
• Relaxed the root symfony/process constraint to ^7.4.5 || ^8.0.5 so the package can resolve with the current Symfony line.
• Upgraded pestphp/pest-plugin-browser to ^4.3.1, which supports Symfony Process 8.
• Updated vulnerable Guzzle transitive dependencies through the lockfile.
• Updated browser tests to use explicit Filament input selectors after the Pest browser plugin upgrade.

Why

Plumb reported negative impact from:

• GitHub Actions referenced by mutable tags instead of immutable SHAs.
• No dependency updater configuration.
• No dependency update cooldown.
• No security disclosure policy.
• Dev/tooling files being shipped in the dist archive.
• symfony/process being constrained to Symfony 7 only.

These changes should improve the next Plumb scan after this branch is merged and a new package release is tagged.

Verification

• vendor/bin/pint --dirty --format agent
• composer validate --strict --no-check-publish
• composer audit --format=plain
• php artisan test --compact
• composer archive --format=zip --dir=/tmp --file=larament-dist-check --no-interaction
• Parsed .github/dependabot.yml locally to verify YAML syntax.

Test result: 42 passed, 133 assertions.

Composer audit result: no security vulnerability advisories found.

Notes

The Composer archive still keeps Laravel directory placeholder files such as .gitignore files under storage/, which are needed to preserve the expected starter-kit directory structure. Generated cache/log files and other local artifacts are excluded.