fix: isolate Swift action updates from dependency groups

[rldyourmnd]

Summary

Exclude swift-actions/setup-swift from the broad GitHub Actions Dependabot group. Swift action updates will be raised separately, so a prerelease major tag cannot travel with unrelated stable updates such as Checkov.

Type of change

• New reusable workflow / capability
• Fix to an existing workflow
• Pinned tool/action version bump
• Hardening / security posture improvement
• Docs only

Threat-model note

This changes Dependabot PR composition only. It adds no token scope, runner, action, code execution, or consumer-facing workflow behavior. The narrower PR boundary makes prerelease and major Swift updates independently reviewable and allows runtime consumer evidence before merge.

Permissions diff

N/A — no workflow or permission block changed.

Checklist

• All existing third-party action pins remain unchanged and full-SHA pinned.
• Existing least-privilege permissions remain unchanged.
• No workflow concurrency, timeout, checkout, expression, or tier contract changed.
• PyYAML parsed the Dependabot configuration and verified the exact exclusion.
• python3 scripts/validate_all.py passed all gates.
• CHANGELOG.md updated under Unreleased.
• Commit is signed, DCO-signed-off, and Conventional Commit formatted.

Tier impact

Repository automation only; no public, private-free, or private-paid reusable workflow runtime changes.