Add dependabot

[mrueg]

What type of PR is this?

• feature

What this PR does / why we need it:

Adds a dependabot configuration for automated dependency and github workflow updates.

Which issue(s) this PR fixes:

None, let me know if I need to create one first.

[Juneezee]

LGTM. Thanks!

[yassinebenaid]

LGTM

[bartekpacia]

Honestly, I don't see a need for it. I always find dependabots warnings to be annoying and not useful.

Also, this module has no dependencies (aside from some utilities for testing), and we aim to keep it this way.

I'm against.

[abitrolly]

-1 on dependabot too. It pollutes search results with irrelevant hits, and mailbox with too much noise.

[mrueg]

If spam is a concern, we can limit the number of PRs it's opening.
As the project has only few dependencies, dependabot will likely open one PR/month.

It also ensures that the github workflows are using their latest actions, which I think is a benefit to ensure that the work flow stays working and eventually saves you from spending time on upgrading it yourselves.

[bartekpacia]

We don't have many GitHub Actions workflow files, and we only use first-party actions from GitHub, and as of now, they're all on the latest version.

Thank you for this PR and I appreciate enthusiasm, but I'm still against (just my opinion. I'm curious what other maintainers think).