ci: pin GitHub Actions to commit SHAs and add Dependabot

Pin every action reference to the full commit SHA that its current tag
already resolves to, with the version kept in a trailing comment. No action
changes version as a result of this commit -- including actions/setup-node
in validate_issue.yml, which stays on v4.4.0 rather than being lifted to the
v6 used by the other workflows. Version bumps are left to Dependabot so they
arrive as reviewable PRs.

Add .github/dependabot.yml for the github-actions ecosystem: weekly on
Monday, minor/patch grouped into a single PR (majors always get their own),
"ci" commit prefix. tibdex/github-app-token is ignored to match
iptv-org-database; it is archived upstream, so replacing it should be a
considered migration rather than an automated bump.

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      actions-minor-patch:
+        update-types: ["minor", "patch"]
+    commit-message:
+      prefix: "ci"
+    ignore:
+      # Held deliberately, matching iptv-org-database. The action is archived
+      # upstream, so moving off it should be a considered migration to
+      # actions/create-github-app-token, not an automated version bump.
+      - dependency-name: "tibdex/github-app-token"