Dependabot: automated dependency and GitHub Actions updates

[mwaldheim]

Goal

Keep dependencies up-to-date automatically — required by OpenSSF Scorecard 'Dependency-Update-Tool' check.

Tasks

• .github/dependabot.yml for Go modules (weekly)
• .github/dependabot.yml for GitHub Actions (weekly)
• Auto-merge Dependabot PRs for patch updates (with passing CI)
• Group minor/patch updates to reduce PR noise
• Set reviewers to CODEOWNERS for major updates

[mwaldheim]

Progress update (2026-05-23):\n\n- Renovate execution workflow added in PR #105 (.github/workflows/renovate.yaml).\n- Existing .github/renovate.json remains in place.\n\nStatus: keep open until PR #105 merges and first Renovate run is verified.