feat(renovate): configure renovate to pin GitHub Actions digests

[oscard0m]

This adds the helpers:pinGitHubActionDigests configuration¹. It will pin GitHub actions tags to digests. For example actions/checkout@v3.0.2 would become actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2

This is recommended by GitHub's security hardening for GitHub actions guide²:

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

Context

Inspired by: octokit/.github#9

Footnotes

---

Footnotes

1. https://docs.renovatebot.com/presets-helpers/#helperspingithubactiondigests ↩ ↩

2. https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions ↩ ↩