refactor: restructure workflows to target layout from github-actions-help

[Copilot]

Summary

Replaces the existing monolithic build.yml and image.yml with the structured workflow layout modelled after maansaake/github-actions-help, adapted for this pure-Go repository.

Changes

Removed

• .github/workflows/build.yml — monolithic lint + test + build
• .github/workflows/image.yml — standalone image build/push

Added

Reusable workflows (called via workflow_call):

• .github/workflows/go.yaml — builds and tests against both stable and oldstable Go releases (matrix), with custom module/build caching, coverage report artifact upload, and builds both locksmith and locksmithctl binaries
• .github/workflows/image.yaml — builds the Docker image; pushes when called with push: true or when triggered directly by release: published

Trigger workflows:

• .github/workflows/main.yaml — runs on push to main; calls go.yaml then image.yaml (build-only, no push)
• .github/workflows/pull-request.yaml — runs on PRs targeting main; same pipeline as main.yaml
• .github/workflows/lint.yaml — runs golangci-lint v2.12.0 on push to main and PRs, uploads results as SARIF to code scanning

Automation:

• .github/workflows/auto-update-pr-branches.yaml — rebases all open PRs onto main after every merge
• .github/workflows/dependabot-auto-approve.yaml — auto-approves and enables auto-merge for Dependabot minor/patch PRs; comments on major updates
• .github/dependabot.yml — weekly grouped Dependabot updates for Go modules, Docker, and GitHub Actions

Notes

• Image pushes are intentionally gated behind GitHub Releases (release: published triggers image.yaml directly with push: true semantics). The main.yaml build is verification-only (push: false).
• auto-update-pr-branches and dependabot-auto-approve require the JEEVES_APP_ID and JEEVES_APP_PRIVATE_KEY secrets for GitHub App authentication (same as the reference repo).
• No Python workflow (py.yaml) was added since locksmith is a pure-Go project.
• The COMMIT build arg is preserved in image.yaml as the locksmith Dockerfile uses it alongside VERSION.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.