dependabot: add ignore rules and groups for Java entries

- Add ignore rules for actions/github-script and github/gh-aw-actions
  to the github-actions entry (SHAs managed by gh aw compile)
- Add ignore for major version bumps on Maven dependencies (may drop
  Java 17 support or have breaking API changes)
- Use dedicated groups for Java: java-maven-deps and java-codegen-deps
  (separate from the monorepo-wide multi-ecosystem-group)
- Give Java entries their own schedule instead of multi-ecosystem-group

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: edburns

.github/dependabot.yaml

@@ -8,6 +8,12 @@ updates:
     directory: '/'
     multi-ecosystem-group: 'all'
     patterns: ['*']
+    ignore:
+      # gh-aw generated files — action SHAs are managed by `gh aw compile`
+      # via .github/aw/actions-lock.json, not by Dependabot.
+      # Dependabot's find-and-replace breaks lockfile metadata headers.
+      - dependency-name: "actions/github-script"
+      - dependency-name: "github/gh-aw-actions"
   - package-ecosystem: 'devcontainers'
     directory: '/'
     multi-ecosystem-group: 'all'
@@ -39,10 +45,23 @@ updates:
   # Java dependencies
   - package-ecosystem: 'maven'
     directory: '/java'
-    multi-ecosystem-group: 'all'
-    patterns: ['*']
+    schedule:
+      interval: 'weekly'
+    ignore:
+      # Major version bumps often drop Java 17 support or have breaking
+      # API changes. These must be evaluated and applied manually.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    groups:
+      java-maven-deps:
+        patterns:
+          - "*"
   # Java codegen dependencies
   - package-ecosystem: 'npm'
     directory: '/java/scripts/codegen'
-    multi-ecosystem-group: 'all'
-    patterns: ['*']
+    schedule:
+      interval: 'weekly'
+    groups:
+      java-codegen-deps:
+        patterns:
+          - "*"