Harden GitHub Actions using full commit SHAs and enable Dependabot for action

This PR: https://github.com/osquery/osquery/pull/9058 got me thinking: We should consider pinning github Actions to a full SHA to protect against supply chain attacks:

Pin actions to a full-length commit SHA

Pinning an action to a full-length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Personally I use that in combination with dependabot to keep my github action SHAs up to date, however that does introduce more PRs to merge. I'm Happy to help review the PRs if that would be useful.

https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions

Start by reviewing the repository's GitHub Actions workflows and the GitHub security guidance linked in the issue, along with the related pull request 9058. Pin third-party actions to verified full commit SHAs and add Dependabot configuration for action updates; done means the workflows are hardened and future SHA updates can be proposed automatically.