ci: pin actions to commit SHAs and add Dependabot config

- Pin actions/checkout and ruby/setup-ruby to full commit SHAs with
  version comments (pinact) to guard against tag-hijack supply-chain
  attacks; Dependabot keeps the pins fresh (weekly, 8-day cooldown,
  minor/patch grouped).
- Document why redmine_gtt is intentionally checked out from its
  moving `next` integration branch.

Addresses Copilot review on PR #72.

Author: dkastl

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    # Defer brand-new releases to reduce supply-chain risk from
+    # freshly published (potentially hijacked) action versions.
+    cooldown:
+      default-days: 8
+    groups:
+      github-actions:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]

.github/workflows/test-postgis.yml

@@ -51,28 +51,32 @@ jobs:
 
     steps:
       - name: Checkout Redmine
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           repository: redmine/redmine
           ref: ${{ matrix.redmine_version }}
           path: redmine
 
       # redmine_gtt is a hard dependency: this plugin uses RedmineGtt::Conversions
       # for geometry and relies on the `geom` column its migration adds to issues.
+      # It is checked out from `next` on purpose: that is redmine_gtt's
+      # integration branch, and this plugin must stay compatible with it.
+      # A CI break caused by a redmine_gtt change is a signal we want early,
+      # not noise to be pinned away.
       - name: Checkout redmine_gtt (dependency)
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           repository: gtt-project/redmine_gtt
           ref: next
           path: redmine/plugins/redmine_gtt
 
       - name: Checkout Plugin
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           path: redmine/plugins/${{ env.PLUGIN_NAME }}
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@a30dfa457ad68707b8b910ac3a244714b61c0626 # v1.320.0
         with:
           ruby-version: ${{ matrix.ruby_version }}