chore: pin third-party GitHub Actions to commit SHAs

[mahangu]

Pins third-party GitHub Actions in this repo to immutable commit SHAs.

This is a draft PR for review before merging. It was prepared with agent assistance and manually verified.

Tracking: DEVPROD-1072

Repo-level summary:

• Pinned distinct third-party action refs in this PR: 3
• Repo-level unpinned usage count from the trunk recheck: 3
• Dependabot GitHub Actions coverage: created (.github/dependabot.yml)

Verification commands:

# 10up/action-wordpress-plugin-deploy # 2.3.0 -> 54bd289b8525fd23a5c365ec369185f2966529c2
gh api repos/10up/action-wordpress-plugin-deploy/commits/2.3.0 --jq '.sha'
# expected: 54bd289b8525fd23a5c365ec369185f2966529c2

# ncipollo/release-action # v1.21.0 -> 339a81892b84b4eeb0f6e744e4574d79d0d9b8dd
gh api repos/ncipollo/release-action/commits/v1.21.0 --jq '.sha'
# expected: 339a81892b84b4eeb0f6e744e4574d79d0d9b8dd

# salsify/action-detect-and-tag-new-version # v2.0.3 -> b1778166f13188a9d478e2d1198f993011ba9864
gh api repos/salsify/action-detect-and-tag-new-version/commits/v2.0.3 --jq '.sha'
# expected: b1778166f13188a9d478e2d1198f993011ba9864

[akirk]

Sounds like the safe approach and we haven't had to change the action in a while anyway.