[llvm] Hashpin sensitive dependencies and configure dependabot to update them automatically (PR #75859)

[Diogo Teles Sant'Anna via llvm-commits]

diogoteles08 wrote:

> I think this looks good. But we have (as Tom said) some other python dependencies that we probably should hash as well. The code formatter workflow and github pr workflow comes to mind. I am happy to handle these in other PR's so we can merge this one.

Sounds great to me! Let me know if you need any help on the other PRs, I'd be happy to help

https://github.com/llvm/llvm-project/pull/75859