chore: release 0.8.7

[limaronaldo]

Summary

• Bump AgentShield to 0.8.7 in Cargo metadata, lockfile, README, changelog, and release notes
• Date the 0.8.7 release notes and align release checklist examples with the current version
• Update Action E2E checkout and SARIF upload actions to current major versions

Validation

• bash .github/scripts/check-release-invariants.sh v0.8.7
• bash docs/harness/bin/sensors.sh release && bash docs/harness/bin/sensors.sh action && bash docs/harness/bin/sensors.sh docs
• git diff --check && cargo fmt --check
• rtk cargo test --all-features
• rtk cargo clippy --all-features -- -D warnings
• cargo build --features full --release
• ./target/release/agentshield --version
• ./target/release/agentshield --help | rg 'wrap|guard'
• ./target/release/agentshield list-rules | rg 'SHIELD-018'
• ./target/release/agentshield scan tests/fixtures/mcp_servers/vuln_cmd_inject --fail-on high exits 1 as expected
• bash docs/harness/bin/release-checklist.sh 0.8.7 --allow-untagged

Note: actionlint is not installed in the local environment, so workflow syntax is covered by GitHub CI.