Pin all 22 action references across ci.yml, publish.yml, and
attest-release.yml to immutable commit SHAs. Mutable tags can be
force-pushed by attackers (cf. TeamPCP supply chain campaign).
Add Dependabot for github-actions to get weekly PRs when pinned
actions have new versions.
