[Task]: Make github actions more secure

[KevinMind]

Description

Based on a great analysis there are a few recommendations we should consider for our repositor(ies)y.

Acceptance Criteria

Milestones/checkpoints

Preview Give feedback

1. verify dependabot from event.<event>.user instead of event.actor
2. add ossf scorecard scanning tool for our repos to detect unsafe workflows
3. analyze our supply chain and ensure we are only using highly trusted sources (most is our own code and mozilla limits what we can use already but doesn't hurt

Checks

• If I have identified that the work is specific to a repository, I have removed "repository:addons-server" or "repository:addons-frontend"

┆Issue is synchronized with this Jira Task