ci: pin github actions by hash and update via dependabot

[xopham]

Description

• Add dependabot for github actions
• Pin all actions by hash

Motivation

Pinning 3rd-party GitHub Actions by commit SHA makes them less vulnerable to compromise of the 3rd party. To avoid outdating and non-verbosity, versions are commented after the SHA and updating via dependabot is introduced that will automatically update the commented version tag as well.

In case of a false commit SHA, this change could break the corresponding workflow. Typically, this does not cause major interruptions, but it can for example affect a release pipeline and require restart causing delays.

Additional Notes

Jira ticket: [PROJ-IDENT]

[dmehala]

LGTM

[dmehala]

@xopham cool, cool. Do you have a tool to check if someone accidentally switched to an unpinned version?

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 93.80%. Comparing base (f590dce) to head (ce5d757).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #180   +/-   ##
=======================================
  Coverage   93.80%   93.80%           
=======================================
  Files          73       73           
  Lines        4195     4195           
=======================================
  Hits         3935     3935           
  Misses        260      260           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.