Hash pin workflows and config dependabot

[joycebrum]

Closes #5410

Hi, I've hash pinned the actions (using step security tool) and configured the dependabot to run only on github actions and to group upgrades on a single PR.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ joycebrum
❌ step-security-bot
_{You have signed the CLA already but the status is still pending? Let us recheck it.}