chore: pin Docker base image digest + add Dependabot config

[ulises-jeremias]

Dockerfile uses mutable tag thevlang/vlang:buster without digest pinning.
Workflows use non-pinned action versions.

Task

1. Pin Docker base image to @sha256:<digest> and configure Renovate/Dependabot
2. Add .github/dependabot.yml for npm + GitHub Actions ecosystems
3. Optionally add dependency-review and CodeQL workflows

Files

• Dockerfile
• New .github/dependabot.yml