ci(deps): add Dependabot version update configuration

[dortort]

Summary

• Adds .github/dependabot.yml covering: npm, github-actions.
• Schedule: monthly.
• Minor and patch updates are grouped into one PR per ecosystem; majors come as separate PRs.
• GitHub Actions updates are grouped into a single PR.
• Security updates are grouped into one PR per ecosystem.
• 7-day cooldown (14 for major npm/pip/cargo bumps) before proposing new releases, as a supply-chain safeguard. Security updates are not delayed.
• Commit messages follow conventional commits (chore(deps), chore(deps-dev), ci(deps)).

Dependabot alerts and security updates were enabled on this repo separately.

🤖 Generated with Claude Code