Add github-actions packaging ecosystem to Dependabot

[alexhambley]

Issue

• See here: https://docs.github.com/en/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories#github-actions
• Our workflows have pinned actions to commit SHAs (with version comments), but .github/dependabot.yml only watches pip
• Adding the github-actions ecosystem makes Dependabot open PRs that bump the SHA and the version comment together whenever an action releases

Fix

See here: https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/auto-update-actions#example-dependabotyml-file-for-github-actions

Something like:

- package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

[douglowe]

We could look at zizmor too: https://docs.zizmor.sh/

Example GH action: https://github.com/UoMResearchIT/Actions/blob/main/.github/workflows/run-zizmor.yml