Document that Dependabot supports updates by commit and that it can update the version references

Author: yeikel

data/reusables/actions/dependabot-version-updates-actions-caveats.md

@@ -1,3 +1,4 @@
-* {% data variables.product.prodname_dependabot %} only supports updates to {% data variables.product.prodname_actions %} using the {% data variables.product.prodname_dotcom %} repository syntax, such as `{% data reusables.actions.action-checkout %}`. {% data variables.product.prodname_dependabot %} will ignore actions or reusable workflows referenced locally (for example, `./.github/actions/foo.yml`).
+* {% data variables.product.prodname_dependabot %} only supports updates to {% data variables.product.prodname_actions %} using the {% data variables.product.prodname_dotcom %} repository syntax, such as `{% data reusables.actions.action-checkout %}` or `actions/checkout@<commit>` . {% data variables.product.prodname_dependabot %} will ignore actions or reusable workflows referenced locally (for example, `./.github/actions/foo.yml`).
+* {% data variables.product.prodname_dependabot %} supports updating the version of {% data variables.product.prodname_actions %} when using a commit along with a tag or a release, such as `actions/checkout@<commit> #<tag>` or `actions/checkout@<commit> #<link to the tag or release>`.
 * Docker Hub and {% data variables.product.prodname_registry %} {% data variables.product.prodname_container_registry %} URLs are currently not supported. For example, references to Docker container actions using `docker://` syntax aren't supported.
 * {% data variables.product.prodname_dependabot %} supports both public and private repositories for {% data variables.product.prodname_actions %}. For private registry configuration options, see "`git`" in [AUTOTITLE](/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#git).