v18.12.2

🧹 Chores

• [ci] Audit GitHub Actions workflows: harden pull_request_target usage, pin all external actions to commit SHAs, and add Dependabot to refresh them. (#3718 by @brentvatne)