Pin our CI to Sha Digests instead of moving version tags and add Renovate maintenance for this. (#1134)

* Move all workflows to digest pinned versioning.

* Infrastructure Upgrades for Automatic Reonvate CI PRs

* Add minimum release age at 7 days for renovate CI updates

.github/workflows/docker-hub-develop.yml

@@ -29,29 +29,29 @@ jobs:
       artifact-metadata: write
     steps:
       - name: Check out
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           fetch-depth: 0
           fetch-tags: true
 
       # Needed for multi platform builds
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a
         with:
           platforms: ${{ env.PLATFORMS }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build image
         id: push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
         with:
           context: .
           file: ./Dockerfile
@@ -77,7 +77,7 @@ jobs:
       - name: Attest pushed image
         id: attest
         if: ${{ env.PUSH == 'true' }}
-        uses: actions/attest@v4
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26
         with:
           subject-name: docker.io/${{ env.DOCKER_NAMESPACE }}/draupnir
           subject-digest: ${{ steps.push.outputs.digest }}