improve dependabot config and commit the lockfile

.github/dependabot.yml

@@ -1,12 +1,45 @@
 version: 2
 updates:
-- package-ecosystem: cargo
-  directory: "/"
-  schedule:
-    interval: daily
-- package-ecosystem: github-actions
-  directory: "/"
-  schedule:
-    interval: daily
-  ignore:
-    - dependency-name: dtolnay/rust-toolchain
+  # bump major and minor updates as soon as available
+  - package-ecosystem: cargo
+    target-branch: main # see https://github.com/dependabot/dependabot-core/issues/1778#issuecomment-1988140219
+    directory: /
+    schedule:
+      interval: daily
+    commit-message:
+      prefix: chore
+      include: scope
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-patch"
+
+  # bundle patch updates together on a monthly basis
+  # (note that security updates will be bumped as soon as available)
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: monthly
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      patch-updates:
+        update-types:
+          - patch
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-minor"
+          - "version-update:semver-major"
+
+  # bump actions as soon as available
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: daily
+    commit-message:
+      prefix: chore
+      include: scope
+    ignore:
+      - dependency-name: dtolnay/rust-toolchain

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ matrix.rust }}
-      - run: cargo test
+      - run: cargo test --locked
 
   test-persistence:
     name: test persistence

.gitignore

@@ -2,6 +2,5 @@
 
 /target
 **/*.rs.bk
-Cargo.lock
 
 /docs/book/book