#24 ci: pin GitHub Action digests in Renovate config

Adds the helpers:pinGitHubActionDigestsToSemver preset to the Renovate config, so Renovate pins GitHub Actions to full commit SHAs (with the version as a comment) and keeps them up to date. It also adds a package rule that automerges minor and patch updates of GitHub Actions.

Made with Cursor