chore(dependabot): group dependabot PRs

[epmog]

Fixes: N/A

What was the problem/requirement? (What/Why)

We get a lot of Dependabot PRs for minor and patch version bumps. Each one has to be reviewed and rebase-merged individually, which is a lot of churn.

What was the solution? (How)

Use Dependabot groups in .github/dependabot.yml to combine all minor and patch updates into a single PR per ecosystem (pip and github-actions). Major version bumps do not match the group and continue to get individual PRs. See also Example 3: Individual pull requests for major updates and grouped for minor/patch updates.

This mirrors OpenJobDescription/openjd-rs#273; the resulting effect can be seen in OpenJobDescription/openjd-rs#275.

What is the impact of this change?

Fewer Dependabot PRs and a better update experience.

How was this change tested?

Config-only change to .github/dependabot.yml, validated as well-formed YAML. The same approach is already in effect in openjd-rs (OpenJobDescription/openjd-rs#275).

See DEVELOPMENT.md for information on running tests.

• Have you run the unit tests? N/A (no code change)

Was this change documented?

N/A (config-only change).

• Are relevant docstrings in the code base updated? N/A (no code change)

Is this a breaking change?

No.

Does this change impact security?

No.

• Does the change need to be threat modeled? For example, does it create or modify files/directories that must only be readable by the process owner?
  • If so, then please label this pull request with the "security" label. We'll work with you to analyze the threats.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.