Harden github actions and workflows

[monokles]

This PR aims to harden Github actions and workflows against malicious actors.
It is an initial pass only, there are several items left for future PRs.

Most of the changes come from findings by either zizmor or actionlint

I have formatted the workflow files for consistency (yamlls), and fixed a typo in one of the job names as well as added a missing job name for the Docker image build.

The substantial changes in this PR (with links to the corresponding audit rules from the tools) are:

• Introduced a cooldown period for dependabot, to somewhat mitigate the risk of supply-chain compromise
• Pinning of unpinned use steps
• Initial attempt at minimizing excessive permissions
• Add concurrency limits to each workflow
• Double quote usage of env-vars to mitigate globbing and word splitting

Note that this changes the default permissions in workflows to the empty set. I have tried to guess the necessary permissions for each job where applicable, but it is very possible I have missed something.
We might want to use https://github.com/GitHubSecurityLab/actions-permissions/tree/main to verify the minimal permissions for each job before this PR gets merged.