CI hardening: job timeouts, concurrency groups, pinned database images, JDK guard, website and CLI coverage

[zantvoort]

• No timeout-minutes on any job in any workflow; a hung image pull can burn six hours of runner time. No concurrency group on ci.yml; rapid pushes queue duplicate 25-minute runs. Both one-line fixes.
• Dialect tests pin postgres:latest, mariadb:latest and gvenzl/oracle-free:latest while MySQL pins 9.2 and MSSQL 2019-latest. An upstream major can break CI overnight with no repo change; pin all images.
• No enforcer rule requiring JDK 21, so building on a machine whose default is 17 fails with a confusing compiler error instead of one clear sentence.
• docs.yml triggers only on push to main, so a PR that breaks the Docusaurus build is caught after merge. Add a build-only website job on pull requests.
• storm-cli/storm.mjs (3,090 lines, executed by users via npx) has no CI at all: no tests, no lint, not even node --check. Add at least a syntax check on PRs.
• No dependabot/renovate config; Spring Boot, Kotlin and the hardcoded Lombok versions drift unwatched. Consider project.build.outputTimestamp for reproducible builds while touching the parent pom.