Vouch request: fcanogab

[fcanogab]

What do you want to work on?

Enable Dependabot and configure it to update the GitHub Actions. Now they are unpinned or reference mutable version tags. Using Dependabot to keep GitHub Actions up to date is, in general, low friction and low risk.
I'll configure the updates with dependency cooldown to reduce the risk of a malicious actions compromising the repository.

Why this change?

Unpinned actions or references to mutable version tags are a software supply chain security risk because if a third party actionis compromised it might impact the whole project. In addition, configuring Dependabot reduces the toil.
One more reason this is recommended is because security scanners raise this risk so the project will receive feedback related to this regularly if not fixed.

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md

[johntmyers]

/vouch

[github-actions[bot]]

@fcanogab has been vouched by @johntmyers.

You can now submit pull requests to OpenShell. Welcome aboard.

Please read CONTRIBUTING.md before submitting.