chore: improve ci security (#9384)

* pin docker files

* pin github actions

* enforce hashes that are already present

* run style checks on cicd changes

.github/dependabot.yml

@@ -14,6 +14,11 @@ updates:
     schedule:
       interval: weekly
 
+  - package-ecosystem: docker
+    directory: /.devcontainer
+    schedule:
+      interval: weekly
+
   - package-ecosystem: pip
     directories:
     - /docs