chore(github-actions): Enable SHA pinning for GitHub Actions

[batch-changes-sourcegraph]

Security: GitHub Actions SHA Pinning

This PR adds Renovate configuration to enable SHA pinning for GitHub Actions
as part of the organization-wide security initiative (APPSEC-1735).

What Changed

• Added .github/renovate.json5 with helpers:pinGitHubActionDigests
• Configured grouping to consolidate all GitHub Actions updates into a single PR
• Docker image updates disabled to keep scope limited to GitHub Actions only

Why This Matters

SHA pinning prevents supply chain attacks via tag repointing. CoreWeave was hit
by this attack vector twice this year (Trivy in March 2026, tj-actions in March 2025).
Our self-hosted runners have access to internal networks and production secrets —
a compromised action has significant blast radius.

What Happens Next

Once merged, Renovate will:

1. Scan all workflow files in this repository
2. Resolve current SHAs for all unpinned actions
3. Open a single PR pinning all actions to commit SHAs

Questions? Reach out in #appsec or #renovatebot.

---

Tracking: APPSEC-1735

Created by Sourcegraph batch change shivawandb/add-renovate-github-actions-sha-pinning.