Pin GitHub Action digests to semver in Renovate configurations

[Copilot]

This PR updates the Renovate configuration files to include the helpers:pinGitHubActionDigestsToSemver helper as recommended by the OpenSSF Scorecard best practices.

Changes Made

Updated both Renovate configuration files to add the required helper:

• ./auto-merge/js/renovate.json - Added "helpers:pinGitHubActionDigestsToSemver" to the extends array
• ./auto-merge/contrib/renovate.json - Added "helpers:pinGitHubActionDigestsToSemver" to the extends array

Why This Change

The helpers:pinGitHubActionDigestsToSemver helper ensures that GitHub Actions are pinned to specific versions using semantic versioning rather than potentially vulnerable tag references. This improves the security posture of the repository by:

1. Preventing potential supply chain attacks through malicious updates to action tags
2. Ensuring reproducible builds by pinning to specific versions
3. Following OpenSSF Scorecard best practices for dependency management

Before

{
  "extends": ["config:base"],
  // ... rest of config
}

After

{
  "extends": ["config:base", "helpers:pinGitHubActionDigestsToSemver"],
  // ... rest of config
}

Fixes #19.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://storage.googleapis.com/chromium-browser-snapshots/Linux_x64/1002410/chrome-linux.zip
  • Triggering command: node install.js (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to my firewall allow list

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.