Enable dependabot dependency updates and pin dependencies by version

[carlewis]

Dependabot is a dependency management and monitoring tool that allows us to avoid supply chain vulnerabilities. Combined with pinned dependencies on our package management systems or GitHub actions, it allows us to keep track of the changes and automatically opens the required pull requests.

Enabling Dependendabot requires repository maintainer permissiones. These are the settings we would recommend: on Settings > Code security and analysis:

• Enable Dependabot alerts
• Enable Dependabot security updates
• Enable Dependabot version updates
• Enable Dependabot on Actions runners

In the following changes we are pinning versions for the GitHub actions and Python Pip requirements.txt file. Dependabot will run weekly, opening a PR suggesting newer versions of each dependency if available.

Another advantage of using this strategy is we will find out if the workflow fails with newer dependency versions in the PR, instead of finding out when we trigger the publish workflow manually.

Also, this should rise the project OSSF score.