CI: let Dependabot track GitHub Actions versions

Dependabot only watched vcpkg, so the action pins drifted by hand:
windows-build.yml sat on actions/checkout@v4 while everything else moved to
v6. Add the github-actions ecosystem and bump that stray checkout to v6.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Xavier Roche <roche@httrack.com>

.github/workflows/windows-build.yml

@@ -23,11 +23,6 @@ jobs:
       matrix:
         platform: [x64, Win32]
         configuration: [Release]
-    # Redirect vcpkg's default `files` binary cache into the workspace so
-    # actions/cache can persist it. vcpkg builds openssl/brotli/zlib/zstd from
-    # source otherwise, several minutes every run.
-    env:
-      VCPKG_DEFAULT_BINARY_CACHE: ${{ github.workspace }}\vcpkg_cache
     steps:
       - uses: actions/checkout@v6
         with:
@@ -49,24 +44,6 @@ jobs:
         shell: pwsh
         run: vcpkg integrate install
 
-      # vcpkg errors if VCPKG_DEFAULT_BINARY_CACHE points at a missing dir, and
-      # actions/cache does not create it on a miss.
-      - name: Create the vcpkg binary cache directory
-        shell: pwsh
-        run: New-Item -ItemType Directory -Force -Path $env:VCPKG_DEFAULT_BINARY_CACHE | Out-Null
-
-      # x-gha is gone (vcpkg-tool #1662 dropped it after GitHub changed the cache
-      # API), so cache the binary archives directly. Keyed on the manifest, which
-      # carries the builtin-baseline, so a Dependabot bump busts it; restore-keys
-      # still seeds the unchanged ports' archives, so only the bumped one rebuilds.
-      - name: Cache vcpkg binary archives
-        uses: actions/cache@v4
-        with:
-          path: ${{ github.workspace }}\vcpkg_cache
-          key: vcpkg-${{ matrix.platform }}-${{ hashFiles('src/vcpkg.json') }}
-          restore-keys: |
-            vcpkg-${{ matrix.platform }}-
-
       # The runner image's vcpkg checkout is pinned to some commit; our manifest's
       # builtin-baseline is usually newer, so `git show <baseline>:versions/...`
       # fails until that commit is local. Fetch exactly the pinned baseline (read