chore: pin third-party GitHub Actions to SHAs + enable Dependabot

[mahangu]

Two-in-one hardening:

1. Pin third-party GitHub Actions in this repo to commit SHAs (tag preserved as trailing comment).
2. Add Dependabot github-actions config (weekly, grouped into actions-minor-patch and actions-major, with cooldown).

Tracking: DEVPROD-1072.

[CLAassistant]

All committers have signed the CLA.

[dangermattic]

	1 Warning
⚠️	PR is not assigned to a milestone.

Generated by 🚫 Danger

[Copilot]

Pull request overview

This PR hardens the repository’s GitHub Actions supply chain by pinning a third-party action to an immutable commit SHA and adding a Dependabot configuration to keep GitHub Actions dependencies up to date.

Changes:

• Pin anthropics/claude-code-action to a specific commit SHA (with the original version retained as a comment).
• Add .github/dependabot.yml to enable weekly, grouped github-actions updates with separate major vs minor/patch groupings.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/claude-review.yml	Pins the Claude review action to a commit SHA to reduce the risk of tag drift/supply-chain tampering.
.github/dependabot.yml	Enables Dependabot updates for GitHub Actions with grouping to reduce PR noise.

[mahangu]

Thanks for checking this. Those refs are intentionally outside this PR’s pinning scope: this campaign pins third-party actions, while GitHub-owned actions/* refs and Automattic-owned reusable workflows such as the run-danger.yml ...@v1 ref are treated as first-party. This PR pins the third-party action ref and adds Dependabot coverage for GitHub Actions, so I’m leaving those first-party refs unchanged.