CI improvements (pin actions, dependabot)

[lukehinds]

Would you be interested in pinning the github actions (I am happy to make the PR)?

At the moment it's using tags: actions/checkout@v4 whereas you can pin to commit SHAs instead, this gives a bit of build reproducibility (tags are floating) and some security protections (someone malicious gets control of the repo and releases bad code under an existing tag).

It would then go from

actions/checkout@v4 to actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

We can also add dependabot if you like with either just the actions update ability (it will persist the use of SHA when it increments each version) or it can also monitor Cargo so when a new version of a dependency is released it will make a PR to bump Cargo.toml

1. Pin actions
2. Dependabot actions update
3. Cargo updates to please!

[l0kod]

I didn't pin them because they are all owned by GitHub.

Versionning Cargo.lock could avoid some issues (e.g. if a dependency bump and become incompatible with MSRV), but I prefer to spot that and update the MSRV accordingly. Maybe a bot could run the tests daily to spot that sooner than later?

[lukehinds]

I think that's fair, some folks do prefer hand pick what the update.

On the pinning, its still worth considering; github has had their own issues recently which highlighted some interesting inefficiencies / exposure. Just let me know if it ever makes sense, happy to help out where I can.