Modify renovate config for better experience

[AdamGS]

Summary

This PR includes 3 somewhat related changes, which should help maintain a better experience and keep the repo somewhat more secure:

1. Pin github actions to hashes instead of versions automatically, this is desirable because github-actions have mutable releases, and no guarantee the code and the release matches, a fact which has been repeatedly abused in recent years.
2. Split the lock file updates by ecosystem, so they don't get blocked on unrelated issues.
3. Instead of automerging patch/minor releases, only do that once a dependency is "stable" in semver terms (post 1.0)