ci: Harden actions and dependabot (a bit) (#7188)

To prevent issues from using GitHub actions and dependabot, I hardened
the workflows using [zizmor](https://docs.zizmor.sh/). There are still
77 open findings. I only applied the ones that are easy wins.

- Pin actions to a commit hash instead of tag - tags are not immutable
(see [`unpinned-uses`](https://docs.zizmor.sh/audits/#unpinned-uses))
- Disable `persist-credentials` on checkout - we don't need it (see
[`artipacked`](https://docs.zizmor.sh/audits/#artipacked))
- Set cooldown on dependabot updates (see
[`dependabot-cooldown`](https://docs.zizmor.sh/audits/#dependabot-cooldown)).
For our own packages, we can manually create PRs.

I left the docker images unpinned, because they're frequently updated,
but zizmor would like to see them pinned as well.

Reviewed-by: pajlada <rasmus.karlsson@pajlada.com>

.github/workflows/reuse.yml

@@ -13,9 +13,11 @@ jobs:
   reuse:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: REUSE license check
-        uses: fsfe/reuse-action@v6
+        uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0
         # I don't want to scare contributors yet, but I want to see progress in actions.
         continue-on-error: true