chore(ci): improve workflows & dependabot (#1928)

* chore(workflow): draft-release - sync recent changes
* chore(workflow): draft-release - pin actions
* chore(workflow): draft-release - use 'npm ci'
* chore(workflow): draft-release - disable package-manager-cache
* chore(workflow): draft-release - ensure cache is '' for clarity
* chore(workflow): draft-release - update actions/checkout configs
* chore(workflow): pin actions in all workflows
* chore(workflow): update actions/checkout configs
* chore(dependabot): added configs
* chore(workflow): use npm cit

.github/workflows/ci.yml

@@ -41,12 +41,15 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-15]
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: ${{ matrix.node-version }}
 
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -61,7 +64,7 @@ jobs:
       # It contains mixed content from the npm package "cordova-js" and "./cordova-js-src".
       # The report might not be resolvable because of the external package.
       # If the report is related to this repository, it would be detected when scanning "./cordova-js-src".
-      - uses: github/codeql-action/init@v4
+      - uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         with:
           languages: javascript, java-kotlin
           queries: security-and-quality
@@ -74,12 +77,11 @@ jobs:
 
       - name: npm install and test
         run: |
-          npm i
-          npm t
+          npm cit
         env:
           CI: true
 
-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
 
       # v4.6.0
       - uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238