Add semver to dependencies #5582
Description
In the github workflows we try to use exact hashes for reproducible builds, but also indicate a semver in the comments which is understood by dependency bots. However, when we have only the hash, the bots can attempt to upgrade to the latest commit (example: #5573), which we don't want, we only want to upgrade to released versions.
We need to find workflows that either specify hash without the semver, or only version without a hash, and update them to action/name@hash # vX.Y.Z. Their respective repos can be used to find the matching hash / semver.