[LOW] Pin workflow actions to immutable commits

[OskarEichler]

Summary

• Pin every third-party GitHub Action invocation to a reviewed immutable commit.
• Retain the human-readable major version in comments.
• Enable Dependabot updates for GitHub Actions so pinned revisions remain maintainable.

Security impact

The build, test, and daily workflows currently execute actions/checkout@v5 and ruby/setup-ruby@v1 through mutable references. A moved or compromised reference would let changed third-party code run in repository workflows. The manually dispatched build job also exposes Docker Hub publishing credentials to its steps.

This change pins:

• actions/checkout to fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 (v5 at review time; verified GitHub commit)
• ruby/setup-ruby to 95ef2b042f9d7a56d8268cba8559e2842e2ad01b (v1 at review time)

Both exact revisions resolve and contain their expected action.yml manifests.

Verification

• All five workflow files and .github/dependabot.yml parse as YAML.
• Every uses: reference is now a full 40-character commit SHA.
• Both pinned repositories and manifests resolve at the recorded commits.
• git diff --check passes.

No runtime source or dependency version changed, so the debugger test suite was not rerun for this workflow-only patch.

Breaking change

None.

Limitations

This patch covers third-party GitHub Actions. It does not make mutable container images or downloaded external build artifacts reproducible; those are separate infrastructure concerns and are not used to publish the gem in these workflows.