chore: harden GitHub Actions workflows

[hiddeco]

• Pin actions to SHAs.
• Set permissions on all workflows.
• Enable Dependabot for GitHub Actions.

[netlify]

✅ Deploy Preview for docs-kargo-render-akuity-io canceled.

Name	Link
🔨 Latest commit	87c8ea3
🔍 Latest deploy log	https://app.netlify.com/sites/docs-kargo-render-akuity-io/deploys/66b1f96eb7836e0008316df7

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 29.58%. Comparing base (c29c1fb) to head (87c8ea3).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #299   +/-   ##
=======================================
  Coverage   29.58%   29.58%           
=======================================
  Files          23       23           
  Lines        1724     1724           
=======================================
  Hits          510      510           
  Misses       1137     1137           
  Partials       77       77           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.