[llvm] Hashpin sensitive dependencies and configure dependabot to update them automatically (PR #75859)

[Tobias Hieta via llvm-commits]

tru wrote:

I think this looks good. But we have (as Tom said) some other python dependencies that we probably should hash as well. The code formatter workflow and github pr workflow comes to mind. I am happy to handle these in other PR's so we can merge this one.

https://github.com/llvm/llvm-project/pull/75859