fix(ci): harden GitHub Actions security and enable Dependabot updates

[idirze]

Description

This PR hardens the GitHub Actions workflows and reusable actions used by this repository.

Main changes include:

• Reduce default GITHUB_TOKEN permissions and scope write permissions only where needed.
• Pin third-party GitHub Actions to immutable commit SHAs.
• Move GitHub expression values into environment variables before shell execution to reduce injection risks.
• Harden branch-name handling in .github/actions/git-branch/action.yml, including support for branch names containing /, such as ci/security.
• Make secret passing more explicit in reusable workflow calls.
• Add Dependabot configuration for GitHub Actions dependency updates.

Type of Change

• Bug fix
• New feature
• Documentation update
• Refactor / chore
• Breaking change

Checklist

• I have tested my changes
• Documentation updated if needed
• If breaking change: migration path described above
• I hereby declare this contribution to be licensed under the [Apache License Version 2.0](http://www.apache.org/licenses/LICENSE-2.0).
• I hereby agree to grant [TOSIT](https://www.tosit.io/) a copyright license to use my contributions.