update all GitHub actions, pin hashes, add dependabot

[alexrashed]

Motivation

While working on #637 I have seen that some of the GitHub actions used in our workflows are not fully up-to-date anymore.
In addition, our best practices have evolved a bit and we are now using pinned action hashes with Dependabot usually.
This PR updates all actions here accordingly and introduces a simple dependabot config.

Changes

• Update every action used in GitHub workflows here to their latest version.
• Instead of using the tag, pin the hash instead and have a comment next to it (which is understood and updated by dependabot).
• Add a simple dependabot config which updates GitHub actions on a weekly basis with a 7 day cooldown (i.e. versions have to be out for 7 days before Dependabot will suggest them).

[quetzalliwrites]

this is fantastic, ty for your contribution @alexrashed