Fix Dependabot CI authentication

[cwperks]

Description

Dependabot-triggered workflows do not receive Actions secrets. This caused:

• report-coverage to upload without CODECOV_TOKEN, which Codecov rejected because the Dependabot branch is protected
• Dependabot PR actions to fail immediately because APP_ID and APP_PRIVATE_KEY were unavailable

This change:

• authenticates Codecov uploads with GitHub OIDC instead of a long-lived secret
• removes the obsolete Dependabot helper workflow

The removed workflow no longer has effective responsibilities: changelog automation was removed, the skip-changelog label is no longer consumed, Spotless is covered by Code Hygiene, and updateShas is skipped because dependency license checks are disabled.

Validation

• parsed .github/workflows/ci.yml successfully
• verified ./gradlew updateSHAs is skipped for all projects on Dependabot PR Bump net.bytebuddy:byte-buddy from 1.18.12 to 1.18.13 #6485
• verified repository rulesets do not require the removed dependabot check
• git diff --check

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ No major issues detected