ci: pin GitHub Actions to commit SHAs and add Dependabot

Pin every action reference to the full commit SHA that its current tag
already resolves to, with the version kept in a trailing comment. No action
changes version as a result of this commit -- including actions/setup-node
in validate_issue.yml, which stays on v4.4.0 rather than being lifted to the
v6 used by the other workflows. Version bumps are left to Dependabot so they
arrive as reviewable PRs.

Add .github/dependabot.yml for the github-actions ecosystem: weekly on
Monday, minor/patch grouped into a single PR (majors always get their own),
"ci" commit prefix. tibdex/github-app-token is ignored to match
iptv-org-database; it is archived upstream, so replacing it should be a
considered migration rather than an automated bump.

.github/workflows/check.yml

@@ -12,7 +12,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Get list of changed files
         id: files
         run: |
@@ -24,7 +24,7 @@ jobs:
           fi
           echo "all_changed_files=$ALL_CHANGED_FILES" >> "$GITHUB_OUTPUT"
           echo "any_changed=$ANY_CHANGED" >> "$GITHUB_OUTPUT"
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         if: steps.files.outputs.any_changed == 'true'
         with:
           node-version: 22