Should we tell dependabot to chill out?

[MylesBorins]

Refs: https://github.com/nodejs/nodejs.dev/issues/668

Nodejs.dev was getting ALOT of noise from dependabot. We ended up changing the settings to only notify us for security related issues and auto land semver-patch

Should we replicate these settings here?

[XhmikosR]

The only change I'd make is switch to weekly or monthly checks.

Having security only should be like not having it enabled, since automated security fixes already do the same.