CI: the four actions at their latest releases, and Dependabot weekly

actions/checkout             v5.0.0 -> v7.0.1
  actions/upload-artifact      v6.0.0 -> v7.0.2
  actions/download-artifact    v4.3.0 -> v8.0.2
  docker/setup-buildx-action   v4.3.0 -> v4.4.1

Each stays pinned to a commit, with the version in its comment.

From the release notes, what the new majors change and why none of it
touches these workflows: download-artifact v5 moved the path of an
artifact fetched by ID, and ours is fetched by name; v8 fails on a
checksum mismatch where v4 said nothing, which is what a publish job
wants. checkout v7 refuses a fork's code under pull_request_target and
workflow_run, and the one workflow_run here checks nothing out. The
Node 24 releases need runner 2.327.1; ours run 2.337.0.

Pinned actions do not update themselves, so .github/dependabot.yml asks
for one grouped pull request a week.

.github/dependabot.yml

@@ -0,0 +1,12 @@
+# Every action is pinned to a commit, so nothing updates by itself. Once a
+# week Dependabot proposes the newer releases in one pull request, moving each
+# commit and the version in its comment together.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]