Check for github-actions updates every week

[arkq]

Problem

There is no automatic check for used github-actions updates. External actions might contain vulnerabilities, so it's better to keep track of any updates.

Changes

• added dependabot config for github-actions
• use only major version number for haya14busa/action-cond action constraint

[github-actions]

PR #25075: Size comparison from a6d2883 to 8a064d6

Full report (3 builds for k32w)

platform	target	config	section	a6d2883	8a064d6	change	% change
k32w	contact	k32w0+release	(read/write)	668916	668916	0	0.0
			.bss	77644	77644	0	0.0
			.data	2200	2200	0	0.0
			.text	569960	569960	0	0.0
	light	k32w0+release	(read/write)	667764	667764	0	0.0
			.bss	77340	77340	0	0.0
			.data	2188	2188	0	0.0
			.text	569124	569124	0	0.0
	lock	k32w0+release	(read/write)	624576	624576	0	0.0
			.bss	75476	75476	0	0.0
			.data	2132	2132	0	0.0
			.text	544240	544240	0	0.0

[yufengwangca]

Could you explain what this automatic check is used for?

[arkq]

It's a dependabot config for checking github action dependencies (actions referenced in uses:). See this: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot

tl;dr; dependabot will raise PRs for actions which can be upgraded