Update GitHub Actions, pin SHA hashes, add Actions Dependabot with cooldown

[pacharanero]

• Actions are out of date, need to update them.
• Dependabot will update actions but only if explicitly set up to do so
• Using latest Actions, or a version tag, can be a vector for supply chain attacks, so we will instead pin to an explicit hash.
• Dependabot will update automatically after a week's cooldown.