CI: let Dependabot track GitHub Actions versions (#693)

Dependabot only watched vcpkg, so the action pins drifted by hand:
windows-build.yml sat on actions/checkout@v4 while everything else moved to
v6. Add the github-actions ecosystem and bump that stray checkout to v6.

Signed-off-by: Xavier Roche <roche@httrack.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/dependabot.yml

@@ -6,3 +6,9 @@ updates:
     directory: /src
     schedule:
       interval: weekly
+
+  # Keep the workflow action pins current (they only rot manually otherwise).
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/windows-build.yml

@@ -23,8 +23,13 @@ jobs:
       matrix:
         platform: [x64, Win32]
         configuration: [Release]
+    # Redirect vcpkg's default `files` binary cache into the workspace so
+    # actions/cache can persist it. vcpkg builds openssl/brotli/zlib/zstd from
+    # source otherwise, several minutes every run.
+    env:
+      VCPKG_DEFAULT_BINARY_CACHE: ${{ github.workspace }}\vcpkg_cache
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           submodules: recursive   # coucal lives in src/coucal
 
@@ -44,6 +49,24 @@ jobs:
         shell: pwsh
         run: vcpkg integrate install
 
+      # vcpkg errors if VCPKG_DEFAULT_BINARY_CACHE points at a missing dir, and
+      # actions/cache does not create it on a miss.
+      - name: Create the vcpkg binary cache directory
+        shell: pwsh
+        run: New-Item -ItemType Directory -Force -Path $env:VCPKG_DEFAULT_BINARY_CACHE | Out-Null
+
+      # x-gha is gone (vcpkg-tool #1662 dropped it after GitHub changed the cache
+      # API), so cache the binary archives directly. Keyed on the manifest, which
+      # carries the builtin-baseline, so a Dependabot bump busts it; restore-keys
+      # still seeds the unchanged ports' archives, so only the bumped one rebuilds.
+      - name: Cache vcpkg binary archives
+        uses: actions/cache@v4
+        with:
+          path: ${{ github.workspace }}\vcpkg_cache
+          key: vcpkg-${{ matrix.platform }}-${{ hashFiles('src/vcpkg.json') }}
+          restore-keys: |
+            vcpkg-${{ matrix.platform }}-
+
       # The runner image's vcpkg checkout is pinned to some commit; our manifest's
       # builtin-baseline is usually newer, so `git show <baseline>:versions/...`
       # fails until that commit is local. Fetch exactly the pinned baseline (read