ci: Pin composite actions SHA

[TonyCTHsu]

Motivation

Followed up on #3146

• Composite actions under .github/actions/* are not pinned
• Dependabot is only configured to scanned .github/workflows

What does this PR do?

• Pin actions under .github/actions/*
• Configure Dependabot to scan composite actions

Reviewer's Checklist

• Changed code has unit tests for its functionality at or near 100% coverage.
• System-Tests covering this feature have been added and enabled with the va.b.c-dev version tag.
• There is a benchmark for any new code, or changes to existing code.
• If this interacts with the agent in a new way, a system test has been added.
• Add an appropriate team label so this PR gets put in the right place for the release notes.
• Non-trivial go.mod changes, e.g. adding new modules, are reviewed by @DataDog/dd-trace-go-guild.
• For internal contributors, a matching PR should be created to the v2-dev branch and reviewed by @DataDog/apm-go.

Unsure? Have a question? Request a review!

[datadog-datadog-prod-us1]

Datadog Report

Branch report: tonycthsu/pin-sha
Commit report: cd6fa2a
Test service: dd-trace-go

✅ 0 Failed, 5406 Passed, 72 Skipped, 2m 47.06s Total Time

[pr-commenter]

Benchmarks

Benchmark execution time: 2025-03-20 12:32:00

Comparing candidate commit 8059a3e in PR branch tonycthsu/pin-sha with baseline commit 8bec53f in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 60 metrics, 2 unstable metrics.