ci: pin varios actions to a proper semver version

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [https://gitea.t000-n.de/t.behrendt/tas-actions](https://gitea.t000-n.de/t.behrendt/tas-actions) | action | pinDigest |  → `cd7a521` |
| [https://gitea.t000-n.de/t.behrendt/trivy-actions](https://gitea.t000-n.de/t.behrendt/trivy-actions) | action | pinDigest |  → `d3dadf6` |

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41LjQiLCJ1cGRhdGVkSW5WZXIiOiI0My41LjQiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImFjdGlvbiIsImRlcHMiXX0=-->

Reviewed-on: #17
Reviewed-by: t.behrendt <t.behrendt@noreply.localhost>
Co-authored-by: Renovate Bot <renovate@t00n.de>
Co-committed-by: Renovate Bot <renovate@t00n.de>

.gitea/workflows/cd.yaml

@@ -4,6 +4,9 @@ on:
   push:
     branches:
       - main
+    paths:
+      - action.yml
+  workflow_dispatch:
 
 jobs:
   release:
@@ -20,4 +23,4 @@ jobs:
           token: ${{ secrets.GITEA_TOKEN }}
       - uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@72551407e761ecdad9bfd421513a1f3b6f252234 # 0.1.2
         with:
-          tag: ${{ steps.tag.outputs.new-tag }}
+          tag: ${{ steps.tag.outputs.new-tag }}

.gitea/workflows/prerelease.yaml

@@ -19,4 +19,4 @@ jobs:
           prerelease: true
       - uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@72551407e761ecdad9bfd421513a1f3b6f252234 # 0.1.2
         with:
-          tag: ${{ steps.tag.outputs.new-tag }}
+          tag: ${{ steps.tag.outputs.new-tag }}

.gitea/workflows/run-tas.yaml

@@ -16,13 +16,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@1.3.1
-      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@1.3.1
+      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@d3dadf6c278b1e86c8f292844225e9c6de230c64 # 1.3.1
+      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@d3dadf6c278b1e86c8f292844225e9c6de230c64 # 1.3.1
       - env:
           TRIVY_CACHE_DIR: ${{ runner.temp }}/trivy
         run: |
           trivy config --cache-dir "$TRIVY_CACHE_DIR" --exit-code 0 --format sarif --output sarif.json .
-      - uses: https://gitea.t000-n.de/t.behrendt/tas-actions/tas-upload-sarif@0.0.2
+      - uses: https://gitea.t000-n.de/t.behrendt/tas-actions/tas-upload-sarif@cd7a5213f75c28565a24fff5ce7f8161869fb813 # 0.0.2
         with:
           tas-base-url: ${{ vars.TAS_BASE_URL }}
           sarif-file: sarif.json

.nvmrc

@@ -1 +0,0 @@
-24