Dependabot does not bump actions referenced from composite actions

[chris48s]

📋 Description

Raised by @LitoMore in #10127 (comment)

We have dependabot configured to upgrade actions we use:

shields/.github/dependabot.yml

Lines 30 to 36 in 1c9d3d5

	# GH actions
	- package-ecosystem: 'github-actions'
	directory: '/'
	schedule:
	interval: weekly
	open-pull-requests-limit: 99
	rebase-strategy: disabled

While this does work for workflows, it is not bumping actions referenced in composite actions.

So for example, #9682 bumped

shields/.github/workflows/test-package-cli.yml

Line 27 in 1c9d3d5

uses: actions/setup-node@v4

but not

shields/.github/actions/setup/action.yml

Line 22 in 1c9d3d5

uses: actions/setup-node@v3

This is a reported issue upstream: dependabot/dependabot-core#6704

We have quite a lot of custom actions: https://github.com/badges/shields/tree/master/.github/actions

Task:

Read through that issue, amend our dependabot config to include actions referenced from composite actions, then review/merge any follow up PRs from dependabot.