fix(build): harden CI workflows to hard-fail and fix dependency scan self-comparison

[WilliamBerryiii]

Problem

Several CI workflow parameters are configured to soft-fail (warnings only) on both PR and main workflows, allowing lint/scan violations to pass silently. Additionally, dependency-scan-main compares refs/heads/main to itself, making it a no-op.

Changes Required

pr-validation.yml (4 parameter changes + 1 version alignment)

• shell-lint: soft-fail: true → soft-fail: false
• terraform-lint: soft-fail: true → soft-fail: false
• code-quality-lint: soft-fail: true → soft-fail: false
• security-scan: grype-soft-fail: true → grype-soft-fail: false
• docs-check-terraform: terraformDocsVersion: 'v0.19.0' → 'v0.20.0'

main.yml (3 polarity fixes + 1 security param + 1 dependency scan rewrite)

• rust-clippy-main: break-build: false → break-build: true
• docs-check-terraform-main: break_build: false → break_build: true
• docs-check-bicep-main: break_build: false → break_build: true
• security-monitoring: add fail-on-critical: true
• dependency-scan-main: use commit-based refs instead of refs/heads/main self-comparison

Acceptance Criteria

• All lint/scan jobs fail the build on errors in both PR and main
• dependency-scan-main compares actual commit ranges
• terraform-docs version aligned across workflows

Related

• Depends on PR fix(build): resolve all 4 main branch CI lint failures #365 (fixes underlying tool failures: ESLint, shell lint, tflint, AIO)
• Related to fix: resolve 4 main branch CI lint failures #360 (original 4 CI failures)