Bump actions/labeler from 6.2.0 to 7.0.0 (#91)

Bumps [actions/labeler](https://github.com/actions/labeler) from 6.2.0 to 7.0.0.
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](b8dd2d9be0...bf12e9b00b)

---
updated-dependencies:
- dependency-name: actions/labeler
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/callable-dependency-review.yaml

@@ -1,6 +1,15 @@
 name: Dependency Review
 on:
   workflow_call:
+    inputs:
+      allow-ghsas:
+        description: >-
+          Comma-separated GHSA IDs to exclude from failing the review.
+          Only for advisories already adjudicated as accepted risk in the
+          calling repo (documented in its .security-review/suppressions.json).
+        type: string
+        required: false
+        default: ''
 permissions:
   contents: read
 jobs:
@@ -11,3 +20,4 @@ jobs:
       - uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: high
+          allow-ghsas: ${{ inputs.allow-ghsas }}

.github/workflows/callable-labeler.yaml

@@ -130,7 +130,7 @@ jobs:
                     - '**/*_spec.rb'
                     - '**/*_test.rb'
           EOF
-      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d  # v6
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13  # v7.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: ${{ runner.temp }}/labeler.yml

.github/workflows/cd-cdk.yaml

@@ -94,7 +94,7 @@ jobs:
             pip install -r "$req"
           done
 
-      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
+      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}

.github/workflows/cd-mobile-ios.yaml

@@ -62,7 +62,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
+      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
@@ -73,7 +73,7 @@ jobs:
           cache: npm
           cache-dependency-path: ${{ inputs.cache-dependency-path }}
 
-      - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
         with:
           ruby-version: ${{ inputs.ruby-version }}
           bundler-cache: true

.github/workflows/cd-sam.yaml

@@ -48,7 +48,7 @@ jobs:
 
       - uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3
 
-      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
+      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}

.github/workflows/compliance-audit.yaml

@@ -76,7 +76,7 @@ jobs:
 
       - name: Run compliance audit
         id: audit
-        uses: anthropics/claude-code-action@af0559ee4f514d1ef21826982bed13f7edc3c35e # v1
+        uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |