chore(ci): harden

[avivkeller]

This PR hardens the CI by explicitly pinning all GitHub actions to their exact commit SHAs. Additionally, it enables Dependabot for future upgrades + security alerts.

[avivkeller]

Note on the required checks:

• Using paths: based workflow is best-practice (since it involves less bash script), but it would require removing enforce-review-rules. I can revert if needed
• test (18.x, ubuntu-latest) should be renamed Test / Foundry project