Introduce automation to keep `pnpm/action-setup` up-to-date

Hello! This issue was created semi-automatically because this repo popped up in a search. Per https://infra.apache.org/github-actions-policy.html, 3rd-party actions such as pnpm/action-setup must be referred to by hash and kept up-to-date by automation such as dependabot. It looks like this repo does not pollow this policy yet.

We plan to start enforcing this policy for pnpm/action-setup through https://github.com/apache/infrastructure-actions/pull/1193 .

If this was a false posivite, you can close this issue. Otherwise, you likely want to update your workflows, since they will stop working once that PR is merged.