No longer pin specific versions of GH actions; they are trusted and there are no secrets or other things to secure and I have not seen breakage because of the pinning.
Slow dependency updates to monthly; weekly is just to noisy and not much added benefits (it has never caught anything new before)
Fix php-cs-fixer to not let it suggest PHP version incompatible fixes