chore(renovate): enable pinDigests for GitHub Actions SHA pinning

Adds `pinDigests: true` to the org-wide Renovate config. Renovate will
now automatically pin all GitHub Actions references to full commit SHAs
and keep them updated via weekly PRs.

This implements the supply-chain hardening goal from PRI-731 without
requiring a one-time manual SHA substitution that would quickly become
stale. Renovate handles pin creation and ongoing updates, eliminating
the toil.

The github-actions packageRule is preserved — Renovate will still group
minor/patch action tag updates, and each group PR will include the
corresponding SHA pins.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

renovate-config.json

@@ -4,6 +4,7 @@
   "baseBranches": ["main"],
   "schedule": ["every weekend"],
   "prConcurrentLimit": 5,
+  "pinDigests": true,
   "packageRules": [
     {
       "matchManagers": ["npm"],