ci: pin GitHub Actions to commit SHAs and add Dependabot

Pin every action reference to the full commit SHA that its current tag
already resolves to, with the version kept in a trailing comment. No action
changes version as a result of this commit -- including actions/setup-node
in validate_issue.yml, which stays on v4.4.0 rather than being lifted to the
v6 used by the other workflows. Version bumps are left to Dependabot so they
arrive as reviewable PRs.

Add .github/dependabot.yml for the github-actions ecosystem: weekly on
Monday, minor/patch grouped into a single PR (majors always get their own),
"ci" commit prefix. tibdex/github-app-token is ignored to match
iptv-org-database; it is archived upstream, so replacing it should be a
considered migration rather than an automated bump.

.github/workflows/format.yml

@@ -9,18 +9,18 @@ jobs:
   main:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: tibdex/github-app-token@v1.8.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: tibdex/github-app-token@0d49dd721133f900ebd5e0dff2810704e8defbc6 # v1.8.2
         if: ${{ !env.ACT }}
         id: create-app-token
         with:
           app_id: ${{ secrets.APP_ID }}
           private_key: ${{ secrets.APP_PRIVATE_KEY }}
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         if: ${{ !env.ACT }}
         with:
           token: ${{ steps.create-app-token.outputs.token }}
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 22
           cache: 'npm'