Pin GitHub Actions to commit SHAs in all workflows

[Copilot]

Mutable version tags (e.g. @v4) can be silently reassigned, making workflows vulnerable to supply chain attacks. All actions should reference immutable commit SHAs with the version tag preserved as a comment.

Changes

• gh-pages.yml — Pinned all 9 action references to commit SHAs:

  # Before
  uses: actions/checkout@v4
  uses: peaceiris/actions-hugo@v3
  
  # After
  uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
  uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f # v3.0.0

• update-desktop.yml — Already fully pinned; no changes needed.

• dependabot.yml — Added Dependabot configuration to automatically check for GitHub Actions updates on a weekly schedule, with all action updates grouped into a single PR.

[infeo]

@copilot Add a dependabot file which checks for updates of the CI actions. They are all grouped in one pr.

[Copilot]

@copilot Add a dependabot file which checks for updates of the CI actions. They are all grouped in one pr.

Added .github/dependabot.yml in e8db75a. It monitors github-actions weekly and groups all action updates into a single PR.