Only allow Dependabot to update the lockfile in src

[jsf9k]

🗣 Description

This pull request sets the versioning strategy in the Dependabot configuration so that it is only allowed to update Pipfile.lock in src; Pipfile will not be altered.

💭 Motivation and context

This should fix PRs like cisagov/code-gov-update#311, where previously Dependabot wanted to incorrectly force the new version as a constraint into the Pipfile.

🧪 Testing

All automated tests pass. The real test would be when Dependabot runs after this PR is merged.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All new and existing tests pass.

[jsf9k]

I'm wondering if the versioning strategy increase-if-necessary might be a better fit for what we want to accomplish with this change. Thoughts, @cisagov/vm-dev?

[dav3r]

I'm wondering if the versioning strategy increase-if-necessary might be a better fit for what we want to accomplish with this change. Thoughts, @cisagov/vm-dev?

AI summary:

You would choose increase-if-necessary over lockfile-only when you want Dependabot to automatically update your manifest file (e.g., package.json, Cargo.toml) whenever a new dependency version falls outside your currently defined semantic version (semver) range.

It makes sense to use lockfile-only instead of increase-if-necessary when your primary goal is to minimize manifest churn and you prefer to handle major or breaking dependency upgrades manually.

Choose lockfile-only if:

• You only want automated PRs for security and bug fixes.
• You want zero changes to your main manifest file from bots.
• You prefer upgrading major tools (like upgrading from Webpack 4 to 5) manually.

Choose increase-if-necessary if:

• You want the bot to handle both security patches and major version upgrades automatically.

---

Based on that, it does sound like increase-if-necessary would be a good fit for us. Can anyone think of any cases where it might backfire on us?

[jsf9k]

cisagov/skeleton-generic#279 made me realize that we perhaps want this versioning strategy globally; as a result I am leaning toward closing this PR in favor of cisagov/skeleton-generic#280.