Simplify CI

[maquchizi]

Summary

Collapses seven workflow files into two and cuts CI cost. The suite ran every job
twice on each PR push (on: [push, pull_request]), installed all of
dev-requirements.txt four separate times to run three linters, and repeated an
identical services + apt + pip setup for pytest and behave. Roughly 135
runner-minutes per PR push down to ~19.

• ci.yml — lint (black/flake8/mypy in one job, off a tools-only install),
  test (pytest + behave sharing one setup), client, and images (default
  branch only, gated on the other three). Adds a concurrency group so
  superseded runs cancel.
• Drops server.yml's install job: its only real step was gated
  if: python-version != '3.12' while the caller passed only '3.12', so it
  booted three services and installed everything to do nothing. Note this leaves
  data/vocabularies.json with no load coverage — re-enabling it needs the
  upstream 3.12 issue fixed first.
• Dependabot: npm/pip version updates removed (upstream owns those trees and we
  take them by merging upstream; bumps here only created merge conflicts), and
  two dead release/3 entries dropped. Actions are now SHA-pinned with
  # vX.Y.Z comments Dependabot resolves and rewrites.
• dockerhub.yml → publish.yml: it pushed to sourcefabricoss/*, upstream
  Sourcefabric's namespace, so it could only ever fail at the push step. Now
  publishes codeforafrica/superdesk-pesacheck-{server,client}.
• Unrelated to the above: black --check . was already failing on pesacheck
  for 7 fork-owned files. Run Black on server/ fixes that. It is formatting
  only and can be reviewed independently of the CI changes.

Test plan

• One CI run per PR push, not two.
• lint green (verified locally against the pinned black/flake8/mypy).
• test green. Service containers moved from mongo 4 / elastic 7.17.25 to
  mongo 6 / elastic 7.17.29 to match docker-compose.yml — this combination
  has not run in CI before.
• images runs only on push to pesacheck, and is skipped when lint,
  test, or client fails.