GCP v10.0: Create the v9 maintenance branch

[pose]

When v10 ships, v9 becomes the maintenance major and v8 goes end of life that same day. This issue creates and wires up the v9 branch.

Acceptance criteria

• Branch v9 created from the highest v9 tag at the time v10 ships.
• Added to team-decision-log/backported-providers.md with base tag and the date its window opens.
• CI adjusted per the backport playbook: make_latest: false, no create_docs_build, explicit npm dist-tag.
• npm latest-v9 dist-tag exists and points at the latest v9, while latest tracks v10.
• .ci-mgmt.yaml sets MaintenanceBranch: v9 (and MaintenanceReleaseDay if the default first-of-month does not suit), so ci-mgmt generates the monthly security-patch tracker issue for the branch. Added in pulumi/ci-mgmt#2431.
• The daily osv-scanner workflow is active on the branch, scanning provider/ and sdk/ for severity-7-and-above vulnerabilities with reachability tracking and posting findings onto the monthly tracker issue. Added in pulumi/ci-mgmt#2433.
• If either workflow needs work to apply to pulumi-gcp, that work is done here or has its own issue.