Harden GitHub Actions workflows

[ulgens]

Parallel to processing/p5.js#9033, I believe all repos under processing organization needs the same base level of hardening for CI pipepilines.

The work will be done in multiple parts:

• Initial pinning of existing dependencies - similar to Pin GHA dependencies p5.js#9032
• Configuring an auto update mechanism, preferably with Renovate
• Enforcing best practices with zizmor and applying the missing fixes