Pin CI dependencies to commit SHAs

[dibarbet]

Summary

• Pin GitHub Actions and Arcade reusable workflows to full commit SHAs while preserving their existing version tracks and readable version comments.
• Pin the external vs-green pipeline template repository to its current main commit.
• Enable weekly GitHub Actions dependency updates through Dependabot.

Keep the release reusable-workflow call on @main and all five 1ESPipelineTemplates references on refs/tags/release, preserving their automatic update channels. Individual actions inside the reusable release workflow remain SHA-pinned.