GitLab

* Use renovatebot to hash-pin GHA
Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>

* Pin dependencies

---------
Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>