ci: adds a ci file with a spellcheck job

[Champbreed]

Adds a CI workflow to check for spelling mistakes in Markdown files on pull requests targeting main. This prevents grammar and spelling mistakes from being merged into the repository

Closes #17

cc: @vikas-agarwal76 @degenaro

[degenaro]

@Champbreed Here is Claude's review:

Scrutinized CI workflow configuration and identified security improvements
Scrutinized CI workflow configuration and identified security improvements

I looked at PR #166 in oscal-compass/community. It's a small, single-commit CI addition — two new files, 28 lines total.

What it does

.github/workflows/ci.yml: adds a spellcheck job that runs on PRs targeting main, but only when **/*.md files change. It checks out the repo (full history via fetch-depth: 0) and runs rojopolis/spellcheck-github-actions.
.github/dependabot.yml: adds daily dependabot updates for the github-actions ecosystem (so the pinned action SHAs above get bumped automatically).

Good practices already in place

Both third-party actions are pinned to a full commit SHA (with the version as a comment), not a mutable tag — this is the secure way to reference actions.
permissions: contents: read is explicitly scoped down (good, avoids default broad token permissions).
The paths: ['**/*.md'] filter means the job won't run on unrelated PRs, saving CI minutes.
Uses pull_request (not pull_request_target), so it won't run with elevated/secret-bearing permissions on untrusted forks — the safer choice for a public repo.
Adding dependabot for the actions ecosystem is a nice complement, since it keeps those pinned SHAs current.

Things I'd flag in review

No visible spellcheck config file — rojopolis/spellcheck-github-actions typically needs a .spellcheck.yml (or similar) to define which paths/sources to scan, dictionary, and a wordlist for allowed technical terms. This PR only adds the workflow, not that config. Given this is the OSCAL Compass project, terms like "OSCAL," "trestle," "SSP," etc. will almost certainly trip a default dictionary and cause noisy false-positive failures unless a custom dictionary already exists elsewhere in the repo (worth asking the author to confirm, or checking).
fetch-depth: 0 looks unnecessary — spellcheck actions like this one usually just walk the matched files in the working tree; they don't need full git history. Full clones are slower for no apparent benefit here — worth asking why it's needed, or switching to default shallow fetch.
No timeout-minutes — minor, but a hung spellcheck job (e.g., a dictionary download stalling) could otherwise run indefinitely on the default runner timeout.
No concurrency group — not critical for a single small job, but a nice-to-have so repeated pushes to the same PR cancel stale runs.
Job only checks .md — reasonable per Closes #17, but worth confirming this is meant to exclude other prose sources (e.g., .rst, code comments, YAML descriptions) that the linked issue might also have wanted covered.

Overall: This is a clean, minimal, well-scoped CI addition with good security hygiene (pinned SHAs, least-privilege token, safe trigger). The main open question before merging is whether spellcheck config/dictionary exists so the job doesn't immediately fail on domain-specific vocabulary — I'd ask the author to confirm that or link a follow-up config PR.