[milt]

Adds a dependency submission workflow for pushes to master and manual runs. It regenerates the tracked POM from the base deps.edn configuration and submits transitive Maven dependencies using contents: write. Development/test alias dependencies are excluded.

A second commit upgrades Clojure to 1.11.4 and pins Jackson Core 2.18.11, Guava 32.1.3-jre, Protobuf 3.25.5, Gson 2.8.9, and Rhino 1.7.14.1. This addresses the existing Clojure alert and vulnerable transitive packages missing from current alert coverage. No source or documentation changes. Supersedes the Clojure-only dependency change in #88; leaves that PR untouched.

Validation:

• Java 11 make ci pom.xml: Clojure 64 tests/263 assertions and ClojureScript 65 tests/266 assertions, zero failures/errors.
• Maven depgraph-maven-plugin 4.0.3 resolved the generated POM successfully.
• Workflow YAML parsed; POM dependency versions and exclusion of dev alias verified; git diff --check passed.
• MCP advisory check reported zero findings for the 29 resolved base Maven dependencies. The checker missed known vulnerabilities in the baseline Guava/Rhino versions, so those upgrades were additionally checked against GHSA-7g45-4rm6-3mm3 and GHSA-3w8q-xq97-5j7x.

Hosted submission and Dependabot refresh require merging and running the workflow on master; they have not yet been verified.