release: v6.0.0

[zkoppert]

Summary

Prepare release v6.0.0. This is a major version bump because it drops support for Ruby versions below 3.3, which is a breaking change for consumers on Ruby 3.1 and 3.2.

Breaking

• Drop support for Ruby < 3.3 (Ruby 3.1 EOL March 2025, Ruby 3.2 EOL March 2026)

Security

• Use HTTPS for cpanminus download in CI to prevent MITM attacks (fix: use HTTPS for cpanminus download in CI #2050)
• Bump nokogiri to >= 1.19.1 to fix GHSA-wx95-c6cv-8532
• Harden CI pip install with --require-hashes --no-deps

Bug Fixes

• Fix RST section ID rendering to iterate all anchors instead of only the first (040f91d)

Infrastructure

• Remove legacy Dockerfile and .dockerignore (Ubuntu Trusty, non-functional) (fix: resolve supply chain security code scanning alerts #2048)
• Add Ruby 4.0 to CI test matrix
• Bump nokogiri to 1.19.2, activesupport to 7.2.3.1
• Bump github-linguist from 7.30.0 to 9.1.0
• Pin GitHub Actions to commit SHAs for supply chain hardening
• Add Dependabot configuration for automated dependency updates

Testing

• All CI checks pass on Ruby 3.3, 3.4, and 4.0
• Gem builds successfully: github-markup-6.0.0.gem

Release Blockers

• Merge PR chore: bump minimum Ruby to 3.3 and add Ruby 4.0 to CI matrix #2051 (Ruby version bump) into master before this PR
• Confirm RubyGems.org push access — current owners: aharpole, nickborromeo, ctmayn, kenyonj, jmeridth. Need one of them to add a current maintainer or push the release.