Adds pinDigests: true so Renovate pins all GitHub Actions references to
full commit SHAs for supply-chain hardening. This repo extends
config:recommended directly, so pinDigests must be set here explicitly —
the org-level config alone is not sufficient.
Recreated from main after closing stale PR #23 (branch was created before
the dual-approval PR #22 landed).
Co-Authored-By: Paperclip <noreply@paperclip.ing>