CI: Update to use immutable hashes and update versions, add dependabot. - #127

Code Scanning could not process the submitted SARIF file: CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled