Merge pull request #14 from brokenpip3/master

pin github-actions has and add scorecard/depenabot