whuppi/ci 2.1.0

• Added a whuppi-ci-refs job to the reusable upgrade-check.yml. It sweeps
  every whuppi/ci/…@vX.Y.Z ref across a consumer's .github (workflow files
  and vendored composite action.ymls alike) to the latest release, in one
  reviewed PR. Dependabot's github-actions updater never reads uses: refs
  inside composite actions
  (dependabot-core#6704,
  open), so a grouped bump moved only the workflow refs and split the pin, which
  pin-availability then rejected. The new job owns that bump and keeps the pin
  uniform by construction. Consumers drop whuppi/ci* from their Dependabot
  github-actions group.

Commits since v2.0.5 (5)

• 3844c43 release: v2.1.0
• a1254e3 feat: sweep whuppi/ci refs to latest via upgrade-check (#32)
• 730ecef chore: bump pinned versions (#29)
• a9a52cd build(deps): bump the actions group across 3 directories with 4 updates (#30)
• 2e1c48c chore: bump pinned versions (#28)