GHA Improvements

[lishaduck]

Some improvements:

• Run GHA in a matrix to catch incompatibility issues faster
  • Add Windows CI #343
• Make some GHA security fixes
  • Pin dependencies
  • Restrict permissions
• Add dependabot
• Update GHA dependencies
• Automate NPM releases (with provenance)
• Document this somewhere (GHA Updates #186 (comment))
• Fix CI running twice on PRs (CI improvements #288)

[lishaduck]

@jfmengels, I just figured out why we hit rate-limits so much: we run CI on push to any branch & on PRs, so it gets run twice.