Update Go testing

[SuperQ]

• Update CI to test all latest versions.
• Bump GitHub actions and pin versions for supply chain security.
• Enable dependabot to update GitHub actions.
• Only build on push to master.

[SuperQ]

👓 @dormando

[dormando]

I'm (personally) very conservative when bumping minimum versions for things. Can you add justifications for it in the commits/PR at least? Maybe separate it out if it's not necessary?

[SuperQ]

I've also tried to be more conservative about bumping minimum versions. But the Go upstream only supports the latest 2 releases.

So I typically recommend most libraries follow this policy.

But I'm happy to increase the support window here.

[dormando]

Thanks! we can tighten that later once I better understand the userbase. memcached has a lot of users with fairly static environments (from bureaucracy or lack of time) but they sometimes need to urgently get a bug fixed.

[SuperQ]

I updated to the latest actions and added a couple additional security changes.

I also added a branch filter on push to avoid double-runs on pull requests that are local (non-fork) branch pushes.

[SuperQ]

Maybe @bradfitz can review this?