Configure Dependabot pull requests for GitHub Actions

[desrosj]

What?

This adds a dependabot.yml file configuring automatic pull requests when there are updates to third-party GitHub Actions released.

Why?

This helps keep our workflows using the latest versions of third-party actions. These can easily fall out of date.

[desrosj]

Wanted to note that we could also configure dependabot PRs for npm dependencies, but I don't think this would have any affect currently because we choose to pin exact versions in our package.json file. The alerts would only work if there were ranges defined using ^, ~, etc. to allow semver updats.

[youknowriad]

Let's see how this goes

[desrosj]

Just to document, I chatted briefly with @youknowriad about this. There was some apprehension as dependabot can be quite noisy at times, and there's not always a lot of benefit to applying every bug fix release. The number of PRs can be limited, but they'll never end in a project of this size.

Dependabot alerts for npm are configured by default, but they are sparse in this repo because exact versions are pinned in our package.json files. Any PRs for npm package updates are from dependencies deeper down the dependency graph (dependencies of our dependencies). So there's probably some benefit there, as these could be npm audit related.