Configure Renovate to pin GitHub Action digests

[rickie]

Verified this against a private Renovate testing repository. Here are some examples of the changes:

-        uses: actions/checkout@v3.1.0
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
...
-        uses: actions/setup-java@v3.8.0
+        uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2 # v3.11.0

So after we merge, we can retrigger Renovate and review the upgrade PRs.
For extra information, see the documentation: https://docs.renovatebot.com/modules/manager/github-actions/

The next hurdle here is figuring out how our suggested commit message bot works with this 🤔.

[github-actions]

Looks good. No mutations were possible for these changes.
Mutation testing report by Pitest. Review any surviving mutants by inspecting the line comments under Files changed.

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[Stephan202]

Tnx!

[rickie]

Suggested commit message:

Configure Renovate to pin GitHub Action digests (#675)

[Badbond]

LGTM. Ran it on a private repo and found nothing out of the ordinary. As to answer:

The next hurdle here is figuring out how our suggested commit message bot works with this thinking.

The PR title is identical, therefore suggest commit message will behave exactly the same as before.

One thing we can consider is moving this into the global configuration; couldn't hurt. In any case, will ✔️.

[rickie]

One thing we can consider is moving this into the global configuration; couldn't hurt. In any case, will heavy_check_mark.

Yeah I can make a PR for that. I think it is nice to have. There are some other repositories that use GHA it I believe.