Revert "Remove actions: write from triage workflow" - #272

Addresses findings from a security review of this repository. These workflows
are consumed by ~45 repositories in the organization, so changes here apply
org-wide.

Add SECURITY.md
  This repository provides the organization's default community health files,
  but had no security policy, so no wp-cli repository surfaced a "Report a
  vulnerability" path. Points at the WP-CLI handbook and the WordPress
  HackerOne program rather than restating policy that lives elsewhere.

Scope `actions: write` to the job that needs it
  It was declared at workflow level, so it also reached `triage-new-item`,
  which runs on `pull_request_target` and processes pull request titles and
  bodies written by anyone who can open a PR. `actions: write` permits
  dispatching workflows and deleting caches and artifacts, a known
  lateral-movement path. Only `triage-unlabeled-items` needs it, and that job
  is `workflow_dispatch`-only.

  The grant has to stay in the caller, since a caller can only cap a reusable
  workflow's permissions and never raise them; removing it there is what broke
  dispatching in #271 and prompted the revert in #272. Comments in both files
  record this so the next attempt narrows rather than removes.

Pin the two unpinned CI dependencies
  `docker://rhysd/actionlint:latest` is built from upstream `main`, not from a
  release: its digest differs from the 1.7.9 tag. Pinned by digest instead.
  Dependabot does not track `docker://` references, so this needs manual bumps.

  `npx --yes gherkin-lint` resolved and executed the newest publish on every
  run. The package was last released in December 2023 and has two maintainers,
  so a single account compromise would reach CI in every repository. Pinned to
  4.2.4.

Correct the actions/setup-node pin comment
  The pinned SHA is v7.0.0, but the trailing comment read v6. The pin itself is
  immutable and current; the comment is what reviewers read, so a wrong one
  quietly defeats the point of the convention.

Fail the WP-CLI download loudly
  `curl -O` without `-f` writes the error body to the file and still exits 0,
  so an outage installed an HTML page as /usr/local/bin/wp and surfaced as a
  confusing failure much later.

Reduce blast radius of the workflow sync
  SKIP_DELETE stops a pattern change from deleting files across every target
  repository. The FILE_PATTERNS regexes now escape their dots so they match
  only the intended paths. Both jobs drop to `contents: read`, since the sync
  authenticates with ACTIONS_BOT and never uses GITHUB_TOKEN to write. The
  schedule drops from every ten minutes to hourly; pushes to the default
  branch still sync immediately.

Addresses findings from a security review of this repository. These workflows
are consumed by ~45 repositories in the organization, so changes here apply
org-wide.

Rebased onto #274, which independently pinned actionlint by digest and added
`--fail` to the two curl calls in the code quality workflow. Those parts of the
review are covered by that change and are dropped here; #274's actionlint pin
resolves to the linux/amd64 manifest of v1.7.11, which is correct for the
GitHub-hosted runners these jobs use.

Add SECURITY.md
  This repository provides the organization's default community health files,
  but had no security policy, so no wp-cli repository surfaced a "Report a
  vulnerability" path. Points at the WP-CLI handbook and the WordPress
  HackerOne program rather than restating policy that lives elsewhere.

Scope `actions: write` to the job that needs it
  It was declared at workflow level, so it also reached `triage-new-item`,
  which runs on `pull_request_target` and processes pull request titles and
  bodies written by anyone who can open a PR. `actions: write` permits
  dispatching workflows and deleting caches and artifacts, a known
  lateral-movement path. Only `triage-unlabeled-items` needs it, and that job
  is `workflow_dispatch`-only.

  The grant has to stay in the caller, since a caller can only cap a reusable
  workflow's permissions and never raise them; removing it there is what broke
  dispatching in #271 and prompted the revert in #272. Comments in both files
  record this so the next attempt narrows rather than removes.

Pin gherkin-lint
  `npx --yes gherkin-lint` resolved and executed the newest publish on every
  run. The package was last released in December 2023 and has two maintainers,
  so a single account compromise would reach CI in every repository.

Correct the actions/setup-node pin comment
  The pinned SHA is v7.0.0, but the trailing comment read v6. The pin itself is
  immutable and current; the comment is what reviewers read, so a wrong one
  quietly defeats the point of the convention.

Fail the WP-CLI download loudly
  `curl -O` without `-f` writes the error body to the file and still exits 0,
  so an outage installed an HTML page as /usr/local/bin/wp and surfaced as a
  confusing failure much later.

Reduce blast radius of the workflow sync
  SKIP_DELETE stops a pattern change from deleting files across every target
  repository. The FILE_PATTERNS regexes now escape their dots so they match
  only the intended paths. Both jobs drop to `contents: read`: the sync
  authenticates with ACTIONS_BOT, and the action reads that token from its
  `with:` input and makes no API calls, so GITHUB_TOKEN is never used at all.