Modernize CI: pinned actions, ruby 3.0–4.0 matrix, trusted publishing

[pcai]

Modernizes CI, replacing the broken build.yml (ruby 2.6–3.1 matrix on removed ubuntu-18.04 runners).

Changes

• New .github/workflows/ci.yml: test matrix ruby 3.0–4.0 on ubuntu-latest + windows-latest (bundle exec rake --trace), plus audit (bundler-audit + ruby-audit), zizmor (pinned v0.6.3), and lint (RuboCop) jobs. Coveralls step dropped — no simplecov in this repo.
• Deleted .github/workflows/build.yml: the old broken workflow.
• Gemfile: added bundler-audit ~> 0.9.3, ruby_audit ~> 3.1 (ruby >= 3.1 only), and rubocop for the lint job. Existing .rubocop.yml kept as-is.
• New .github/workflows/gem_push.yml: trusted-publishing release workflow (rubygems/release-gem v1.4.1) triggered on published releases, gated by the new release environment (pcai as required reviewer). RubyGems trusted-publisher registration is still needed before the first release.
• New .github/dependabot.yml: weekly GitHub Actions updates.
• New issue templates (Bug_report.md, Feature_request.md) and PULL_REQUEST_TEMPLATE.md, adapted for winrm-elevated.
• New RELEASING.md: release process adapted to this repo (VERSION file, winrm-elevated.gemspec, changelog.md).
• No CHANGELOG.md created — the repo already keeps changelog.md (lowercase), which RELEASING.md references.
• required_ruby_version untouched.

Verification

• CI green on this PR (audit, zizmor, lint, test x 12)
• RubyGems trusted publisher still needs to be registered for winrm-elevated before the first trusted-publishing release (requires an OTP step by the gem owner)