Add pull request automation: labels, Dependabot, and security workflows

[Paururo]

Ports the bot, label and pull-request-format setup from get_MNV, adapted to snpick (a Rust CLI with no frontend).

What this adds

• Labels. .github/labeler.yml plus a labeler workflow put part-of-the-project labels on a pull request from the files it changes: core, vcf, filters, bindings, documentation, packaging, tests, ci.
• Dependabot. Grouped monthly updates for the cargo crate, the docs pip requirements and the workflow actions, with routine (minor and patch) updates kept apart from majors. The routine group is auto-merged once CI is green; majors always wait for a person.
• CodeQL. Static analysis on push and pull request over the two languages present here, rust and actions.
• Dependency review. Refuses a pull request that would add a dependency with a known vulnerability, at moderate severity and above.
• Mutation testing. A manual cargo mutants run, split across four shards, that reports which logic no test distinguishes. It is advisory and never fails the build.
• Stale sweep. A weekly pass that marks issues untouched for three months and closes them a month later, leaving anything labelled bug, security or pinned alone.
• Pull request template. Replaced with a shorter one focused on what changed, why, and how it was verified.

MSRV footgun fix

The MSRV job in rust.yml pinned its compiler as dtolnay/rust-toolchain@1.74.0. With the github-actions Dependabot ecosystem now enabled, that ref would be treated as a tag to bump, and a routine update to a newer ref would quietly build the job on a different compiler while still calling itself the MSRV check. The version now lives in the action's toolchain input, so the minimum supported Rust version only moves when that line does.

Notes

• Labels referenced by Dependabot and the labeler are created in the repository, since Dependabot skips labels that do not exist.
• The labeler runs on pull_request_target, so it does not label this pull request (the base branch has no labeler config yet); it takes effect once merged.
• Two repository settings are outside this pull request: enabling Dependabot security updates, and setting Actions workflow permissions to read and write so auto-merge and the labeler can write.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.