[actions] github actions updates

[dopey]

• Move dependabot to common workflow
• add github actions to dependabot
• Move away from deprecated create-release action
• use SHAs for external actions