ci(renovate): configured to pin gh action digests

[travi]

to mitigate the risk of mutability. for more details, see https://github.com/ossf/scorecard/blob/27cfe92ed356fdb5a398c919ad480817ea907808/docs/checks.md#pinned-dependencies

[travi]

i've been using this approach in my other projects for some time now and it has been smooth, so it seems like time to bring the improvement here too. this is the config that i extend in most of my other projects: https://github.com/form8ion/renovate-config/blob/6054675930983f9caea3e11bd16ef3c116b8af93/default.json#L7

[travi]

here is an example of the update that renovate will propose in our workflow files: https://github.com/form8ion/javascript/pull/397/files

[gr2m]

It might cause quite some noise, but no reason not to give it a try, we can re-evaluate any time.