CI: Harden GitHub Actions

- Use commit SHAs instead of floating versions
- Manage upgrades via dependabot
- Reduce dependence on third-party actions