Ci enhancements

[ShantanuKodgirwar]

What and why

Small CI maintenance changes.

• Cancel outdated PR runs: a new push to a PR now cancels the older Tests and Docs runs still in progress. Runs on main are never cancelled.
• Test on Python 3.10: requires-python is >=3.10, but CI only tested 3.11–3.13. Added 3.10 to the test matrix in test.yml and to the pre-release tests in publish.yml.
• Align docs.yml: now uses actions/checkout@v6.0.2 and astral-sh/setup-uv@v8.0.0 with the same pyproject.toml cache as the other workflows.
• Dependabot: new .github/dependabot.yml checks GitHub Actions versions monthly and opens PRs for updates.
• Read-only token for tests: test.yml now sets permissions: contents: read.

How it was tested

• Ran the CI test steps locally (uv sync --extra dev, uv run pytest tests) on Python 3.10.21 and 3.12.12.
• uv build works, and all workflow and Dependabot YAML files parse.
• The new workflow settings take effect on this PR's own CI run.

Notes

None