.github: Harden action workflows

[pdgendt]

Some improvements to the Github workflows:

• Pin action version hashes
• Set explicit default permission
• Add a dependabot configuration to check for updates

[marc-hb]

Is there a bit more context for this?

I imagine the idea is to review action changes before upgrading them which sounds more secure in theory but... who is going to actually perform the audit in practice? Or maybe the idea is to just delay the upgrade, hoping someone else's supply chain gets compromised first and finds out first?

[pdgendt]

Is there a bit more context for this?

I imagine the idea is to review action changes before upgrading them which sounds more secure in theory but... who is going to actually perform the audit in practice? Or maybe the idea is to just delay the upgrade, hoping someone else's supply chain gets compromised first and finds out first?

So there has been some fuss around a compromised action, also used in the zephyr repository.
These changes are recommended by the Open Source Security Foundation and similar efforts are being done for zephyr:
zephyrproject-rtos/zephyr#87311
zephyrproject-rtos/zephyr#87254
zephyrproject-rtos/zephyr#87153
zephyrproject-rtos/zephyr#87309
zephyrproject-rtos/zephyr#81812

This is a first step, more will probably follow.