Harden the CI workflow

Actions pinned to full commits, no token left in the checkout, no binaries
from a fork's pull request among the artifacts, the version passed through the
environment, an audit of the NuGet packages, time limits, one release at a
time with checksums and never over another commit's release, and Dependabot
for the actions and packages.

.github/dependabot.yml

@@ -0,0 +1,14 @@
+# Pull requests for new versions of the pinned actions and of the NuGet packages,
+# so a fix for a vulnerability reaches the build without anyone watching for it.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: nuget
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5