ci: add Dependabot updates for GitHub Actions

[nkbranigan]

Set up automated updates with Dependabot for GitHub Actions used in CI/CD.

• ci: pin GitHub Actions to commit SHAs #450 pinned actions to specific versions. This PR will ensure that those pins don’t become outdated, improving security and function.
• Choices I made:
  • Update frequency: once per month (reduce PR noise)
  • Cooldown period: 7 days (wait to see if version is stable and safe)
  • Updates grouped into a single PR (reduce PR noise)

[slinderman]

Thanks @nkbranigan!