ci: modernize checkout action + add permissions + Dependabot

[jhamon]

What

Safe CI hardening for pinecone-text:

1. actions/checkout@v3 → v4 — v3 is outdated.
2. Least-privilege permissions — adds permissions: contents: read to the PR CI.
3. Dependabot — .github/dependabot.yml for pip (poetry) + github-actions.

The existing black / mypy / pytest matrix is unchanged.

Two deferred decisions (need your call)

• This repo is a published "text client library" — borderline vs. the SDK exclusion. If it belongs to the separate SDK process, close this PR.
• EOL Python in the test matrix — CI currently tests Python 3.9 (EOL) and 3.10 (near-EOL). Dropping them is what the CI-quality goal wants, but for a published library that's coupled to your support policy (and requires-python), so I left the matrix alone rather than make that call here.
• A pip-audit gate would also be worth adding once the support/scope questions above are settled.

🤖 Generated with Claude Code

---

Note

Low Risk
Workflow and Dependabot config only; no application code, auth, or runtime behavior changes.

Overview
CI hardening for pull-request runs: the workflow now declares permissions: contents: read (least privilege) and bumps actions/checkout from v3 to v4. The existing OS/Python test matrix and test steps are unchanged.

Dependency automation: adds .github/dependabot.yml with weekly pip updates (minor/patch grouped, up to 10 open PRs) and weekly GitHub Actions updates (up to 5 open PRs).

^{Reviewed by Cursor Bugbot for commit 6e26368. Bugbot is set up for automated code reviews on this repo. Configure here.}