chore: modernize CI and update Go toolchain

- Bump Go from 1.19 to 1.26 and update all dependencies
- Rewrite CI workflow with matrix strategy (Linux, macOS, Windows)
- Update GitHub Actions to current versions (checkout@v4, setup-go@v5)
- Update CodeQL actions from v1 to v3
- Fix cross-platform bug in mock/path.go (path.Join -> filepath.Join)
- Clean up dependabot config (weekly schedule, remove stale ignore)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

vendor/github.com/alecthomas/chroma/v2/renovate.json5

@@ -1,11 +1,24 @@
 {
-  $schema: "https://docs.renovatebot.com/renovate-schema.json",
-  extends: [
-    "config:recommended",
-    ":semanticCommits",
-    ":semanticCommitTypeAll(chore)",
-    ":semanticCommitScope(deps)",
-    "group:allNonMajor",
-    "schedule:earlyMondays", // Run once a week.
-  ],
+	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
+	"extends": [
+		"config:recommended",
+		":semanticCommits",
+		":semanticCommitTypeAll(chore)",
+		":semanticCommitScope(deps)",
+		"group:allNonMajor",
+		"schedule:earlyMondays", // Run once a week.
+		'helpers:pinGitHubActionDigests',
+	],
+	"packageRules": [
+		{
+			"matchPackageNames": ["golangci-lint"],
+			"matchManagers": ["hermit"],
+			"enabled": false
+		},
+		{
+			"matchPackageNames": ["github.com/gorilla/csrf"],
+			"matchManagers": ["gomod"],
+			"enabled": false
+		}
+	]
 }