chore: pin dependency fix for rust toolchain

[deepakraog]

pin dependencies in github actions #132

Scorecard(Locally)

Note - Observation:

npm doesn’t support hash-based pinning like GitHub Actions do. I tried few things but the node_module build itself propagates warning.
Here what i tried:
Create a package.json in .github/workflows directory.
Define renovate as a dependency with a specific version.
Commit the generated package-lock.json to lock the version and all sub-dependencies.
and in workflow add

• name: Install Renovate
  run: npm ci --prefix .github/workflows