chore: pin third-party GitHub Actions to commit SHAs

[mahangu]

Pins third-party GitHub Actions in this repo to immutable commit SHAs.

This is a draft PR for review before merging. It was prepared with agent assistance and manually verified.

Tracking: DEVPROD-1072

Repo-level summary:

• Pinned distinct third-party action refs in this PR: 1
• Repo-level unpinned usage count from the trunk recheck: 2
• Dependabot GitHub Actions coverage: created (.github/dependabot.yml)

Verification commands:

# snok/install-poetry # v1.4.2 -> a783c322200f0519c7926aa6faa857c4e23e9263
gh api repos/snok/install-poetry/commits/v1.4.2 --jq '.sha'
# expected: a783c322200f0519c7926aa6faa857c4e23e9263