Add dependabot for security updates

[imnasnainaec]

Only for security updates. We'll bump other packages when we're syncing with the extension template.

[imnasnainaec]

I'm wondering if this will just be annoying to have, since they are updating the template when CVEs arise.

[alex-rawlings-yyc]

@imnasnainaec do we want to close this issue? I think I agree with your comment left on May 1, but it might be worth bringing up tomorrow morning to confirm that we want to close this or actually add dependabot (or perhaps defer dependabot until we actually start to release)

[imnasnainaec]

We probably need one of the following two:

• Our update-from-the-template process to also include bumping major/minor versions of the deps we add beyond the template
• A dependabot configuration that excludes all packages coming from the template