This switches from rolling tags to explicit SHA1 hashes for all actions, not just certain third-party actions. All hashes include a trailing comment with the targeted tag.
This also adds a dependabot config file for automated monthly PRs, to avoid having to update manually. Third-party actions will only be updated on major/minor version bumps and official actions will be grouped into one PR, unless it's a major version bump.