ci: add zizmor and dependabot

[kaiburjack]

Add zizmor (Static check for GitHub actions) for security-related issues in GitHub actions.
Findings fixed:

1. not SHA-pinned actions: This is a door for supply-chain attacks, which have been happening recently: Attackers getting access to a GitHub action project and re-publishing action versions under existing (mutable) tags. This can be avoided by explicitly SHA-pinning. This is a finding also found by zizmor and dependabot will also follow this convention when suggesting updates.
2. overly broad workflow/job permissions. Reduced to the absolute necessary permissions per job, and no permissions at all per workflow.
3. not persisting Git credentials in checkout action.

Another useful workflow change: concurrency control: abort a workflow run when a new commit on the same ref/branch/tag tiggers a new workflow

Also, this PR adds a dependabot.yml configuration for Go dependencies, GitHub actions and docker, following zizmor best practices (zizmor can also audit dependabot.yml files).