🚀 Feature: Disable pinDigests for Renovate

[JoshuaKGoldberg]

Bug Report Checklist

• I have pulled the latest main branch of the repository.
• I have searched for related issues and found none that matched my issue.

Overview

Following #1894 & #1895: I don't want GHA digests to be pinned. It's annoying and I want to stick with semver.

Additional Info

I understand the value in preserving commit hashes. It's good for security to ensure they can't be tampered with; it prevents accidental changes over time; etc. - https://docs.renovatebot.com/docker.

But I don't find those arguments persuasive enough to turn on these updates by default in all CTA repos. A big point of CTA is to make friendly, readable config files. Big ole hashes in GHA files is not that.

💖

[JoshuaKGoldberg]

Ehh, on second thought, I think this is good to stay. Pinning to hashes is a legitimate security concern. If someone feels strongly about this, please respond here and we can discuss. 🙂