chore(deps): pin dependencies

[ferrlabs-renovate]

This PR contains the following updates:

Package	Type	Update	Change
Swatinem/rust-cache	action	pinDigest	→ 6323deb
actions/checkout	action	pinDigest	→ d23441a
docker/build-push-action	action	pinDigest	→ 10e90e3
docker/login-action	action	pinDigest	→ c94ce9f
docker/metadata-action	action	pinDigest	→ c299e40
docker/setup-buildx-action	action	pinDigest	→ 8d2750c
raven-actions/actionlint	action	pinDigest	→ 3d39aea
sigstore/cosign-installer	action	pinDigest	→ 398d4b0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[ferrfleet]

Digest-pinning only, no version bumps: each action stays on the same tag (checkout v6, rust-cache v2, buildx v3, login v3, metadata v5, build-push v6, cosign-installer v3), just with a SHA added. Spot-checked checkout@v6, build-push-action@v6, and cosign-installer@v3 against the actual tag commits on GitHub and all three digests match. Both CI jobs (Check, Image builds) are green. Nothing to flag.