[llvm] Hashpin sensitive dependencies and configure dependabot to update them automatically (PR #75859)

[Tobias Hieta via llvm-commits]

tru wrote:

@diogoteles08 do you need us to merge this or do you have write acccess?

https://github.com/llvm/llvm-project/pull/75859