dependabot config for github actions

[bigcat88]

I noticed that the GitHub actions are quite old here, and I'm too lazy to update them manually all the time - so let's make sure that Depandobot does a PR with updates once a month and it doesn't take up developer's time.

Also pinned the 3rd party action by hash to remove the last warning (Unpinned tag for a non-immutable Action in workflow) from GitHub on this topic:

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@           Coverage Diff           @@
##             main     #306   +/-   ##
=======================================
  Coverage   47.91%   47.91%           
=======================================
  Files          30       30           
  Lines        3068     3068           
=======================================
  Hits         1470     1470           
  Misses       1598     1598           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.