Pin third-party actions to commit SHAs and add Dependabot for action updates

[kploch]

Follow-up from #1 (PR fixing the SonarCloud authentication bug).

While fixing #1 the action references in this repository were reviewed. None are pinned to a commit SHA, which SonarCloud flags as githubactions:S7637 ("Using a mutable reference for a third-party GitHub Action is security-sensitive").

Current references:

File	Reference	Owner
build-test-sonar/action.yml	actions/setup-java@v5	GitHub (first-party)
build-test-sonar/action.yml	actions/setup-dotnet@v6	GitHub (first-party)
test-script-action/action.yml	Amadevus/pwsh-script@v2	third-party
.github/workflows/run-test-action.yml	actions/checkout@v3	GitHub (first-party, and two majors stale)

Amadevus/pwsh-script@v2 is the genuinely third-party one and the highest priority: a mutable tag means an upstream compromise or force-push would execute in any workflow using it.

This was deliberately left out of the #1 fix to keep that change minimal, because build-test-sonar is consumed at @main by other repositories and every change ships to them immediately.

Suggested scope:

• Pin all uses: references to full commit SHAs with a trailing # vX.Y.Z comment.
• Add .github/dependabot.yml with the github-actions ecosystem so pinned SHAs do not silently rot.
• Bump actions/checkout@v3 to the current major while in there.

Pinning without Dependabot just trades one problem for another, so the two should land together.

[kploch]

Two more stale references found while auditing every uses: on the #1 branch, not covered by the table above:

File	Reference
build-test-snar-ps/action.yml	actions/setup-java@v4
build-test-snar-ps/action.yml	actions/setup-dotnet@v3

These were left alone in #3 on purpose: build-test-snar-ps is an unfinished scaffold (it is still titled "Hello World Action", contains no SonarScanner steps, and never invokes its own build-test-sonar.ps1), so bumping it had no benefit and only widened a diff that ships to consumers at @main.

Worth deciding as part of this issue whether build-test-snar-ps and test-script-action should be brought up to date or simply deleted. If they are dead, deleting them removes the Amadevus/pwsh-script@v2 third-party exposure entirely, which is a better outcome than pinning it.