VCST-4843: Pin third-party actions to SHAs and automate updates

[AndrewEhlo]

Pins every third-party uses: reference (non-VirtoCommerce/* owners) in .github/workflows/ and workflow-templates/ to a 40-character commit SHA with a trailing # tag comment, per GitHub's supply-chain hardening guide. Tags are mutable; SHAs are not.

16 workflow + template files re-pinned across actions/, docker/, aquasecurity/, zaproxy/ (etc.).
aquasecurity/trivy-action switched from @master to v0.36.0 SHA — the only ref previously tracking a branch.
New pinact.yaml declaring scan paths and VirtoCommerce/* ignore.
New .github/workflows/pin-check.yml — runs pinact run -check on every PR that touches workflows or templates; fails on unpinned uses: lines.
Internal VirtoCommerce/* refs (vc-github-actions, jira-upload-*, reusable workflows) are intentionally left as version-/branch-pinned — they're not third-party.

Layers automated maintenance onto the SHA pinning from #.

.github/dependabot.yml — weekly grouped github-actions updates. Dependabot reads the # tag comment, bumps SHA + comment together when upstream cuts new tags.
.github/workflows/auto-update-templates.yml — Mondays 08:00 UTC, runs pinact run -update workflow-templates/*.yml and opens a PR via peter-evans/create-pull-request. Closes the gap where Dependabot's github-actions ecosystem doesn't scan workflow-templates/.
README section documenting both flows + the contributor playbook (how to look up a SHA for a new action).

---

Note

Medium Risk
Primarily CI configuration changes, but it modifies many workflows and introduces automated PR creation; mis-pins or token/permissions issues could break builds or create noisy PRs.

Overview
Hardens GitHub Actions supply chain by converting third-party uses: references in .github/workflows/ and workflow-templates/ from floating tags/branches to pinned 40-char SHAs (including switching aquasecurity/trivy-action off @master) and bumping the internal template/workflow version marker to v3.800.34.

Adds automation to keep pins current: a new weekly grouped Dependabot config for github-actions, a scheduled auto-update-templates workflow that runs pinact and opens a PR for template pin bumps, and a pin-check workflow that fails PRs if any third-party actions aren’t SHA-pinned (scoped via new .pinact.yaml, ignoring VirtoCommerce/*). Documentation in README.md is updated to describe the policy and contributor workflow.

^{Reviewed by Cursor Bugbot for commit 2b275b3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2631b66. Configure here.}