ci: pin container base images by digest, validate Gradle wrapper, add Dependabot

Supply-chain hardening for the OpenSSF Scorecard findings not covered by
the open Token-Permissions (#197), CodeQL (#198) and Scorecard workflow
(#194) pull requests.

* Pin the node base images in heka-auth-service/Dockerfile and
  heka-identity-service/Dockerfile by manifest-list digest
  (Pinned-Dependencies)
* Add a Validate Gradle Wrapper workflow (gradle/actions/wrapper-validation,
  SHA-pinned) running on pushes to main and pull requests so the committed
  heka-wallet gradle-wrapper.jar is verified against Gradle's published
  checksums (Binary-Artifacts)
* Add .github/dependabot.yml for github-actions and the two docker
  directories so the pins above keep getting refreshed

Signed-off-by: Michael Garber <michael.garber@hashgraph.com>

Author: mgarbs

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "docker"
+    directories:
+      - "/heka-auth-service"
+      - "/heka-identity-service"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10

.github/workflows/gradle-wrapper-validation.yml

@@ -0,0 +1,36 @@
+name: Validate Gradle Wrapper
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  validation:
+    name: Validate Gradle Wrapper
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+
+      - name: Validate Gradle Wrapper
+        uses: gradle/actions/wrapper-validation@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0

heka-auth-service/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22 AS builder
+FROM node:22@sha256:8a34c4ab3ea2c5cd194f07e317b2a8f09461d3c8b05c4e34c8ccd56d56024c4d AS builder
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
@@ -13,7 +13,7 @@ RUN yarn install --immutable
 COPY . .
 RUN yarn build
 
-FROM node:22-bookworm-slim
+FROM node:22-bookworm-slim@sha256:83f487e0a63425e5b4d146fb5e5be574bcbe1b7b843d3ebafdd95eaf7767a7e5
 
 RUN apt-get update && apt-get install curl -y
 

heka-identity-service/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-bullseye-slim
+FROM node:22-bullseye-slim@sha256:5736e7ef1f3f2109be7ef8aea0cbdf931804aee9a18c6760507b8ded078b25a9
 
 ARG EXPRESS_PORT