ci: pin action versions to SHA + add github-actions to Dependabot

Dependabot will now open PRs when new versions of actions/checkout and
actions/setup-node are released, keeping the pinned SHAs up to date.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

.github/dependabot.yml

@@ -7,3 +7,8 @@ updates:
     groups:
       dev-dependencies:
         dependency-type: "development"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"