docs: round out v9.15 release notes with stragglers

Adds entries for items that landed after the release notes were first
written:

  - Housekeeping: #9906 (Italian translation update, merged from
    origin/master).
  - Test-suite stability: 208541cc4 (ImportExportServersTestCase
    sys.executable + subprocess error surfacing).
  - Documentation (new subsection): 9923eefca (clarification that
    MAX_LOGIN_ATTEMPTS applies only to INTERNAL auth; LDAP / OAuth2 /
    Kerberos / Webserver brute-force protection is the upstream IdP's
    and reverse-proxy's responsibility).
  - Dependencies (new subsection): the cumulative non-breaking
    dependabot updates aggregated for v9.15, organized by Python /
    JavaScript (web/) / JavaScript (runtime/), listing the
    package-level diffs without commit-keyed framing. Covers both
    aggregating commits (d55ffe405 and 4330a688a) so a reader looking
    for "what versions did 9.15 ship with" finds it in one place.

Sphinx build remains clean for release_notes_9_15.rst.