chore(ci): Repo-wide SHA pinning of actions/*, persist-credentials: false, and Dependabot config

[coderabbitai]

Summary

Pin all actions/* action references across .github/workflows/ to full commit SHAs instead of floating version tags (e.g., @v6, @v8), add persist-credentials: false to every actions/checkout step, and add a Dependabot config (.github/dependabot.yml) so the pinned SHAs auto-update.

Motivation

Currently, all jobs in ci.yaml (and other workflows) use major-version tags for actions/checkout, actions/upload-artifact, actions/download-artifact, etc. zizmor flags these as unpinned-uses and artipacked violations. Fixing only a single job (e.g., the new wheel-test job added in #78) would create inconsistency, so the fix should be applied uniformly across the repo.

Work items

• Audit all .github/workflows/*.yaml and .github/actions/**/action.yaml for actions/* references using floating tags
• Replace each with the corresponding full commit SHA
• Add persist-credentials: false to every actions/checkout step
• Add .github/dependabot.yml with package-ecosystem: github-actions so Dependabot opens PRs to keep SHAs current

References

• Flagged by zizmor (unpinned-uses, artipacked) during review of feat(build): Add CI test that builds+tests the wheels #78
• Requested by @matthewgrossman in feat(build): Add CI test that builds+tests the wheels #78 (comment)