Integrate vulnerability scanning + dependency monitoring into CI/CD across temporal & airflow

### Problem statement

From this cycle 26.10, security engineering has made the following mandatory for all team products (per feedback on the SSDLC vulnerability response plan ):

1. Vulnerability scanning routines (e.g. trivy, sec-scan / sbomber) integrated into CI/CD.
2. Dependency management / monitoring tools (e.g. Dependabot, Renovate) integrated into CI/CD.

Reference: SEC0025 appendices (reference implementations included by sec-eng).

This is distinct from SEC0025's per-cycle Vulnerability Tracker requirement that captures a static snapshot once per cycle; this mandate is about continuous, automated coverage so that new CVEs and outdated deps are surfaced as soon as they're published.

Current state across team-owned products:
- Vulnerability scanning: a workflow exists in this repo (.github/workflows/sbom_secscan.yaml) and covers Temporal's charms today.
- Dependency monitoring: GitHub's Dependabot security updates are passively running on the three Airflow charm repos and surfacing GHSA-driven PRs. No repo has a committed .github/dependabot.yml

### Enhancement Proposal

Vulnerability scanning (this repo):
Extend .github/workflows/sbom_secscan.yaml to cover Airflow alongside Temporal.

Dependency monitoring (per repo):
- Charm repos (uv-based): add an explicit .github/dependabot.yml covering uv, github-actions, and docker (where relevant). Dependabot security updates are already running; the committed config makes coverage auditable and adds version updates.
- Rock repo (rockcraft.yaml-based): Dependabot doesn't support rockcraft.yaml, so adopt Renovate with custom-regex managers or a custom CI cron as fallback.

### What needs to get done?

Vulnerability scanning (this repo)
- [ ] Re-run the Airflow scan via workflow_dispatch on the open PR branch
- [ ] Merge the airflow-manifest PR

Dependency monitoring (per repo)
Airflow product:
- [ ] canonical/airflow-coordinator-k8s-operator - add .github/dependabot.yml
- [ ] canonical/airflow-core-operators - add .github/dependabot.yml
- [ ] canonical/airflow-kubernetes-executor-k8s-operator - add .github/dependabot.yml
- [ ] canonical/airflow-rocks - adopt Renovate with custom-regex managers for rockcraft.yaml

Temporal product:
- [ ] canonical/temporal-k8s-operator - add .github/dependabot.yml
- [ ] canonical/temporal-ui-k8s-operator - add .github/dependabot.yml
- [ ] canonical/temporal-worker-k8s-operator - add .github/dependabot.yml
- [ ] canonical/temporal-admin-k8s-operator - add .github/dependabot.yml

- [ ] Address existing unmerged Dependabot security PRs across the 3 active Airflow charm repos