chore(ci): pin deps in workflow and add dependabot to update them weekly

[zerosnacks]

Pinning hashes for dependencies in workflows is a security best practice

Excluded from pinning are actions from the github/* and actions/* given that these are officially managed by Github and are not raised by zizmor

By configuring dependabot with package-ecosystem: "github-actions" it will open a pull request only for updating pinned hashes (not cargo, etc..): https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot#enabling-dependabot-version-updates-for-actions

The <hash> #<branch_name> syntax is what dependabot picks up on

rust-toolchain pinning per https://github.com/dtolnay/rust-toolchain?tab=readme-ov-file#choice-of-full-length-commit-sha policy

[grandizzy]

👍

[zerosnacks]

Temporarily moving back to draft, some specific handling is required for dependabot to work correctly