ci: restore generated blocking security scans

[KooshaPari]

Recreates the reviewed security restoration from #3792 on current upstream main 74db8b5b.

• Restores blocking PR-only Dependency Review with read-only contents permission.
• Restores blocking Trivy filesystem/dependency vulnerability scan with pinned actions and non-persistent checkout credentials.
• Updates the Rust generator, emitted workflow, and parity assertion together.

Validation: cargo test -p forge_ci --test ci (8 passed); focused security invariant (1 passed); git diff --check. actionlint is unchanged from baseline: six existing SC2086 infos in generated release steps.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

KooshaPari seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}