[codex] Hard-fail platform security reusables

[NWarila]

Summary

• removes caller-controlled advisory modes from reusable IaC security
• makes Trivy, Gitleaks, and zizmor findings blocking by default
• removes dependabot[bot] from reusable auto-merge trusted authors

Validation

• workflow YAML parse via PyYAML
• rg found no remaining advisory/dependabot trust patterns in the hardened reusable workflows
• git diff --check

Resolution note

The pasted backlog suggested bumping Vault from 7093eaa to platform main, but current platform main still contained the advisory inputs and dependabot trust. This PR creates the hardened platform source SHA first; Vault can then pin to this commit after merge.