ci: pin every action by commit and move dependency updates to Dependabot

Every external action is pinned to a full commit SHA with its version tag in a comment, GitHub's own actions/* included; the org's reusable workflows stay on @main. Renovate is replaced by Dependabot for the github-actions ecosystem, checked quarterly in one grouped pull request.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: robingenz

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: quarterly
+    groups:
+      github-actions:
+        patterns:
+          - '*'

.github/workflows/ci.yml

@@ -16,8 +16,8 @@ jobs:
       matrix:
         node-version: [22, 24]
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
@@ -31,8 +31,8 @@ jobs:
     needs: verify
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: .nvmrc
           cache: npm