fix(ci): bump pinned actions and stop dependabot editing generated workflow yaml

[qubeena07]

Summary

Closes #3357.

Dependabot kept bumping actions/checkout, actions/setup-python and actions/setup-dotnet directly inside the workflow yaml files, which put them out of sync with the pins recorded in .github/ci/actions.toml and made the Check generated workflows job fail.

This updates actions.toml to checkout 7.0.0, setup-python 6.3.0 and setup-dotnet 5.4.0, regenerates policy-engine-ci.yml from that source, and applies the same pins across every other workflow file that references those actions so everything matches again.

It also adds an ignore list to the github actions block in dependabot.yml so those five actions can only be bumped by updating actions.toml and regenerating, which is what actually caused this failure in the first place.

Test plan

• python3 scripts/ci/generate_workflows.py --check passes, generated workflows are up to date
• all workflow yaml and dependabot.yml parse cleanly with yaml.safe_load
• grepped for the three old pinned SHAs across .github, none remain

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

🤖 AI Agent: security-scanner — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

No security issues found.

[github-actions]

🤖 AI Agent: code-reviewer — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

TL;DR: 0 blockers, 1 warning. Changes improve workflow consistency but require validation of the updated action versions.

#	Sev	Issue	Where
1	Warn	Updated GitHub Actions versions require validation for compatibility.	.github/ci/actions.toml

Action items:

1. Validate the updated versions of actions/checkout@v7.0.0, actions/setup-python@v6.3.0, and actions/setup-dotnet@v5.4.0 to ensure compatibility with the workflows.

| # | Sev | Issue | Where |
|----|------|-----------------------------------------------------------------------|
| 1 | Warn | Updated GitHub Actions versions require validation for compatibility. | .github/ci/actions.toml |

[github-actions]

🤖 AI Agent: docs-sync-checker — Docs Sync

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Docs Sync

Documentation is in sync.

[github-actions]

🤖 AI Agent: breaking-change-detector — API Compatibility

AI-generated review output. Treat it as untrusted analysis and verify before acting.

API Compatibility

No breaking changes detected.

[github-actions]

🤖 AI Agent: test-generator — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Test coverage looks good. No gaps identified.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[qubeena07]

Hi @MohammadHaroonAbuomar @liamcrumm, checks are all green here and it looks mergeable. Could one of you take a look when you get a chance?

This one is also blocking #3367, since that PR synced its composite action pins against the current registry and this PR moves setup python to v6.3.0. Whichever merges second needs a rebase and a rerun of generate_workflows.py with write, so I would like to get this one in first if possible. Thanks.