Add dependabot config

[felixfontein]

No description provided.

[webknjaz]

@felixfontein why do you think this is needed? I'd rather keep major-tag-driven versioning in the smoke tests to keep the noise down in such a low-traffic project. Besides, the only action it'd bump is the official actions/checkout@v3. Is it worth it?

[felixfontein]

@webknjaz I usually add this config to all my projects so I won't forget about updating things like actions/checkout@v3 to a newer version (and I don't have to do it manually). Also these updates only happen very rarely, so this is only very seldomly resulting in something to do.

You have to decide whether you find this useful; I personally do, but if you rather want to notice the version change yourself, that's up to you.

(It would be nicer if dependabot would also check the action itself, but I haven't yet figured out how to let it do that...)

[webknjaz]

I don't like when it bumps the patch versions but if it could do just v3->v4, that'd be acceptable.

[felixfontein]

I've never seen it do that. I guess it only does it if you start having patch versions in the actions in the first place (and IMO then it makes sense to update these).

[webknjaz]

Okay, let's see how it goes..