ci: pin sborka actions to v0.5.0.130

[youndie]

Pins every youndie/sborka action and reusable workflow this repository calls from @main to the release tag v0.5.0.130 (youndie/sborka#123). With @main, a merge to sborka changed this repository's CI at once, with no pull request of its own and without this repository's build ever running on the change; with a tag, Renovate proposes each new sborka tag as a pull request (the github>youndie/sborka preset carries the rule that reads the four-part tag), and that pull request runs this repository's build. v0.5.0.130 is the first tag in which publish-wip.yaml also takes its own inner actions from the same revision rather than from @main.

Refs youndie/sborka#123