Pin github actions and update them to the latest version

[shkarface]

Pin the the github actions in use, let dependabot update them regularly

I have also added a 7 day cooldown for dependabot updates

[Romfos]

Hello,

What is the benefit for us to have pinned versions?
As I see we already have dependabot and it do proposition of updates like #968

thank you

[shkarface]

@Romfos it's better to pin the version for security reason, as we've seen recently there has been many CI attacks like this.

[zvirja]

I think it creates inconveniences and it's the first time I see this kind of an issue. So I would suggest to not apply the change - it's exactly how it is in every other open source project I know.

Could you elaborate a bit more on the security scenario? Our project is totally open source running on a public GitHub Actions - I cannot possibly imagine which security issues are possible at all 🤔 We don't have any secrets to hide and the only one is push to nuget, but that is protected by who could run the trigger.

Thank you @shkarface