CLOUD-410 ktlo: pin GitHub actions to commit SHAs

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+      time: "13:00"
+      timezone: "Europe/Berlin"
+    cooldown:
+      default-days: 3

.github/workflows/build-and-run-tests.yml

@@ -12,14 +12,14 @@ jobs:
     name: Build and run action on on NodeJs 10
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
+      - uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2
         with:
           node-version: 10
       - run: sudo apt update
       - run: sudo apt-get install firefox -y
-      - uses: actions/checkout@v2
-      - uses: nanasess/setup-chromedriver@v1
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
+      - uses: nanasess/setup-chromedriver@20b60ce40e290aad331f1d26c1d699a5408208bd # v1
         with:
           chromedriver-version: '99.0.4844.51'
       - name: Install dependencies
@@ -28,6 +28,6 @@ jobs:
       - run:  cd sample_project && ../node_modules/.bin/bower install
       - run: cd ..
       - name: Run headless test
-        uses: GabrielBB/xvfb-action@v1
+        uses: GabrielBB/xvfb-action@86d97bde4a65fe9b290c0b3fb92c2c4ed0e5302d # v1
         with:
          run:  grunt test