use hashes for dependencies, use app for bumpversion commits

[Zeitsperre]

Overview

Changes:

• Added support for Birdhouse Helper Bot (bumpversion)
• CI Actions and Python dependencies are now pinned to hashes
• Permissions have been set for all workflows
• Pinned cf-xarray below v0.9.3 (breakages)
• Reformatted and renamed CHANGES.rst to CHANGELOG.rst.

[Zeitsperre]

@fmigneault This PR addresses the build failures in #384