CI: hash-pin sensitive workflow and configure dependabot to keep them updated

CI: hash-pin sensitive workflow and configure dependabot to keep them updated #767