ci: pin third-party action SHAs and add Dependabot cooldown

.github/dependabot.yml

@@ -9,3 +9,6 @@ updates:
     directory: ".github/actions/core" # Location of package manifests
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
+      semver-major-days: 14

.github/workflows/build-and-test.yml

@@ -2,8 +2,7 @@ name: Build & Test
 
 on:
   pull_request:
-    branches:
-      - main
+    branches: [main]
     types:
       - opened
       - synchronize

.github/workflows/codeql.yml

@@ -28,7 +28,7 @@
 
 name: "CodeQL Advanced"
 
-on:
+on:  # zizmor: ignore[pull-request-target]
   push:
     branches: [main]
   pull_request:

.github/workflows/release.yml

@@ -40,7 +40,7 @@ jobs:
 
             - name: Generate Changelog
               id: changelog
-              uses: mikepenz/release-changelog-builder-action@v6
+              uses: mikepenz/release-changelog-builder-action@348e88fab4c37338b1e803ceb2d4a7a5db6c0833 # v6
               with:
                   configuration: "configuration.json"
                   mode: "COMMIT"
@@ -171,7 +171,7 @@ jobs:
                   git push -f origin "v$MAJOR_VERSION"
 
             - name: Create Release
-              uses: softprops/action-gh-release@v3
+              uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
               with:
                   tag_name: "v${{ inputs.version }}"
                   name: "v${{ inputs.version }}"