release: bump 0.8.8 -> 0.8.9 (#285)

Maintenance release — supply-chain and CI housekeeping only. No library code or
public API changes.

### Security
- Triaged the pyo3 advisories RUSTSEC-2026-0176 / RUSTSEC-2026-0177 as not
  affecting Wickra (vulnerable APIs unreachable from the binding; fix blocked
  upstream by rust-numpy pinning pyo3 `^0.28`). Recorded in `deny.toml` and
  `osv-scanner.toml`.

### Changed
- Java binding: `central-publishing-maven-plugin` 0.5.0 → 0.10.0.
- CI GitHub Actions bumped to latest (checkout, setup-go, setup-java,
  codeql-action, taiki-e/install-action).
- Added a Maven ecosystem to Dependabot.

Version bumped across all manifests/lockfiles via `bump_version.py`; Cargo.lock
refreshed. CHANGELOG `[0.8.9]` filled. Tag/publish to follow on explicit GO.

bindings/node/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickra",
-  "version": "0.8.8",
+  "version": "0.8.9",
   "description": "Streaming-first technical indicators: incremental, fast, install-free. Node bindings powered by Rust.",
   "author": "kingchenc <support@wickra.org>",
   "main": "index.js",
@@ -47,12 +47,12 @@
     "node": ">= 18"
   },
   "optionalDependencies": {
-    "wickra-linux-x64-gnu": "0.8.8",
-    "wickra-linux-arm64-gnu": "0.8.8",
-    "wickra-darwin-x64": "0.8.8",
-    "wickra-darwin-arm64": "0.8.8",
-    "wickra-win32-x64-msvc": "0.8.8",
-    "wickra-win32-arm64-msvc": "0.8.8"
+    "wickra-linux-x64-gnu": "0.8.9",
+    "wickra-linux-arm64-gnu": "0.8.9",
+    "wickra-darwin-x64": "0.8.9",
+    "wickra-darwin-arm64": "0.8.9",
+    "wickra-win32-x64-msvc": "0.8.9",
+    "wickra-win32-arm64-msvc": "0.8.9"
   },
   "scripts": {
     "build": "napi build --platform --release",