ci: pin GitHub Actions to commit SHAs and add Dependabot

Pin every action reference to the full commit SHA that its current tag
already resolves to, with the version kept in a trailing comment. No action
changes version as a result of this commit -- including actions/setup-node
in validate_issue.yml, which stays on v4.4.0 rather than being lifted to the
v6 used by the other workflows. Version bumps are left to Dependabot so they
arrive as reviewable PRs.

Add .github/dependabot.yml for the github-actions ecosystem: weekly on
Monday, minor/patch grouped into a single PR (majors always get their own),
"ci" commit prefix. tibdex/github-app-token is ignored to match
iptv-org-database; it is archived upstream, so replacing it should be a
considered migration rather than an automated bump.

.github/workflows/validate_issue.yml

@@ -15,9 +15,9 @@ jobs:
       contains(github.event.issue.labels.*.name, 'streams:edit')
     steps:
       - name: Checkout repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
-      - uses: tibdex/github-app-token@v1.8.2
+      - uses: tibdex/github-app-token@0d49dd721133f900ebd5e0dff2810704e8defbc6 # v1.8.2
         if: ${{ !env.ACT }}
         id: create-app-token
         with:
@@ -25,7 +25,7 @@ jobs:
           private_key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: 'npm'