chore: pin GitHub actions to commit SHAs and add dependabot

[Nityam43]

📝 Summary

This PR hardens the repository's CI/CD supply chain security by replacing all floating action tags with strict 40-character commit SHAs. This prevents potential tag-hijacking attacks (which is especially critical in publish.yml given its OIDC trusted publishing permissions). It also resolves the Node.js 20 deprecation warnings currently showing in the CI runs.

🛠️ Changes Made

• Pinned Actions: Updated all 12 uses: references across ci.yml and publish.yml to target explicit 40-character commit SHAs.
• Version Bumps: Bumped actions/checkout to v7.0.1 and actions/setup-node to v7.0.0 (via their respective SHAs).
• Dependabot Integration: Added a new .github/dependabot.yml file configured for the github-actions ecosystem. This ensures these pinned SHAs will be automatically updated by dependabot on a weekly schedule.

✅ Verification

• npm run verify passes locally (Prettier formatting, TypeScript, tests, and build).
• CI workflows on this PR will run without triggering the Node.js 20 deprecation annotations.
• All 7 CI jobs (Node 18/20/22/24, legacy 14.18/16, and runtimes) continue to pass cleanly.
• Verified publish.yml triggers and permissions remain completely untouched.

Closes #21