security: configure Dependabot for pnpm and GitHub Actions

[danielmarv]

Problem

The repository currently has no Dependabot configuration. As a result, updates for JavaScript dependencies and GitHub Actions must be identified and opened manually.

Adding Dependabot will help keep dependencies current and improve the OpenSSF Scorecard Dependency-Update-Tool check.

Proposed solution

Add a .github/dependabot.yml configuration that:

• Checks the npm/pnpm dependencies in the repository root.
• Checks GitHub Actions dependencies under .github/workflows/.
• Runs both checks weekly.
• Applies appropriate labels, such as dependencies and configuration.
• Uses reasonable limits to avoid creating too many simultaneous pull requests.
• Groups compatible development dependency updates where practical.

Acceptance criteria

• .github/dependabot.yml is added and accepted by GitHub.
• Updates are enabled for the npm package ecosystem using the repository's pnpm-lock.yaml.
• Updates are enabled for the github-actions package ecosystem.
• Both update schedules run weekly.
• A reasonable open pull request limit is configured.
• Dependabot pull requests receive appropriate labels.
• Compatible development dependency updates are grouped where appropriate.
• The YAML configuration is valid and documented clearly.

References

• Dependabot configuration options
• OpenSSF Scorecard: Dependency-Update-Tool