pin actions to commit SHAs in workflows (#744)

* fix basic validation with npm command

* Revert "fix basic validation with npm command"

This reverts commit 27a0803a2a.

* pin workflow actions to full commit SHAs with patch

* update cooldown

* update redundant global.json test and rollForward fields

* update cooldown for npm section

.github/dependabot.yml

@@ -12,6 +12,8 @@ updates:
     # Check the npm registry for updates every day (weekdays)
     schedule:
       interval: 'weekly'
+    cooldown:
+      default-days: 7
 
   # Enable version updates for GitHub Actions
   - package-ecosystem: 'github-actions'
@@ -20,3 +22,5 @@ updates:
     directory: '/'
     schedule:
       interval: 'weekly'
+    cooldown:
+      default-days: 7