ci: add dependabot package updating

[robjtede]

partly so that we have PRs to merge to resolve the stuck issues faster

this config set up is pretty good for application projects in my experience

[paolobarbolini]

I think it's a good idea in general to automate dependency updates. Considering that dependabot ignores the interval setting when it comes to security updates ¹, I wouldn't run this daily.

partly so that we have PRs to merge to resolve the stuck issues faster

Actually we haven't automated deployments to the server, so merging a PR doesn't fix the stuck issues 😅

Footnotes

1. https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#scheduleinterval ↩