Build: Refer to commits of GitHub Actions, upgrade them

Also, set up automatic Dependabot updates of actions grouped into a single PR
as Core does.

Ref jquery/jquery#5503

Author: mgol

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly
+
+    # Group all dependabot version update PRs into one
+    groups:
+      github-actions:
+        applies-to: version-updates
+        patterns:
+          - "*"

.github/workflows/node.js.yml

@@ -3,8 +3,10 @@
 name: Node.js CI
 
 on:
-  - push
-  - pull_request
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
 
 jobs:
   build:
@@ -16,13 +18,14 @@ jobs:
         node-version: [18.x, 20.x]
 
     steps:
-    - name: Install xmllint
-      run: sudo apt-get install -y libxml2-utils
-    - uses: actions/checkout@v3
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v3
-      with:
-        node-version: ${{ matrix.node-version }}
-        cache: 'npm'
-    - run: npm ci
-    - run: npm test
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Install xmllint
+        run: sudo apt-get install -y libxml2-utils
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+      - run: npm ci
+      - run: npm test

.github/workflows/spider-check.yaml

@@ -21,7 +21,8 @@ jobs:
       # Site address to crawl
       MY_SITE: https://api.jquery.com
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Run hydra-link-checker
         run: |

.github/workflows/typesense.yaml

@@ -16,7 +16,8 @@ jobs:
     if: ${{ github.repository_owner == 'jquery' }} # skip on forks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Docsearch Scraper
         shell: bash
         run: |