chore(ci): pin actions through cdkactions 2.2.0 and sync Dependabot bumps

[martinjlowm]

Prerequisite: the push job of the new pin-sync workflow needs the
org's APP_ID and APP_PEM Dependabot secrets, which reach private and
internal repositories only. Until someone adds them to devkit, that job
fails on every Dependabot github-actions PR.

The action pins in .github/cdk/main.ts moved only by hand, and
Dependabot's github-actions updates were turned off because the next
synth reverted them.

Now, .github/cdk uses @factbird/cdkactions 2.2.0:

• Each step is a typed action pinned with .pinned(sha, version), and
  the synth fails when a tag no longer points at its commit.
• A DependabotActionPinSync workflow carries Dependabot's SHA bumps from
  .github/workflows back into main.ts, so the github-actions ecosystem
  is back in .github/dependabot.yml, weekly and grouped.

Action	Version	Commit
actions/checkout	v7.0.1	3d3c42e5aac5ba805825da76410c181273ba90b1
DeterminateSystems/determinate-nix-action	v3.23.1	d0c908e6cbe9f89f36ed8205a3ab6f092636916a
DeterminateSystems/update-flake-lock	v29	da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3
actions/setup-node	v6.5.0	249970729cb0ef3589644e2896645e5dc5ba9c38

The pin-sync workflow also uses the commits cdkactions itself pins for
create-github-app-token, upload-artifact and download-artifact.

Mind that synth writes those library pins from cdkactions, not from
main.ts, so a Dependabot bump to an action the pin-sync workflow uses,
checkout included, fails its "Check the source reproduces the workflows"
step until cdkactions releases the new pin.

Closes #11

_{Made with ❤️ by Claude (Opus 5.5)}

[martinjlowm]

Merge danger

Door: two-way. Reverting the PR restores cdkactions 2.1.2 with plain
SHA strings in .github/cdk/main.ts, removes the pin-sync workflow and
drops the github-actions entry from .github/dependabot.yml again.

Blast radius: local. The update-nixpkgs workflow keeps the same
commits and gains only step ids. The new pin-sync workflow runs only on
Dependabot PRs that touch .github/workflows. Its push job fails on every
such PR until someone adds the org's APP_ID and APP_PEM Dependabot
secrets to devkit, since they reach private and internal repositories only.

Expand for what I ran and what stays unverified

• In .github/cdk, with Node.js from devkit's locked nixpkgs and yarn
  4.14.1 through corepack: yarn install --immutable, yarn typecheck
  and yarn build passed. A second yarn --cwd .github/cdk build
  changed nothing, and nix fmt -- --no-cache changed nothing.
• The synth's pin check, run against GitHub without GITHUB_ACTIONS,
  exited 0 with no warning. cdkactions verify-action-pins .github/cdk/main.ts printed "4 versioned pin(s) checked: each tag points
  at its pinned commit." I ran both outside the sandbox, with sh from
  nixpkgs, because the sandbox refused to spawn git and /bin/sh.
• actionlint .github/workflows/*.yaml passed, and all 8 uses: lines end
  in a 40-hex SHA.
• nix flake check -L passed on aarch64-darwin. I did not build the Linux
  systems.
• In a throwaway copy, I bumped actions/checkout to v7.0.0 in both
  workflows and committed it. sync-action-pins --base HEAD~ rewrote
  main.ts to checkoutV7.pinned('9c091bb…', 'v7.0.0'), and the synth
  reproduced cdkactions_update-nixpkgs.yaml. It put v7.0.1 back in
  cdkactions_dependabot-action-pin-sync.yaml, which is the caveat in the
  body.
• The pin-sync workflow has not run on GitHub.

_{Made with ❤️ by Claude (Opus 5.5)}