Add Dependabot for automated dependency updates

[kasnder]

What

Adds .github/dependabot.yml to automate routine dependency bumps, and encodes the MaxMind geoip2 version constraint as an enforced rule.

Supersedes #626, which was branched off an unmerged triage-doc commit and conflicted with master. This is the same dependabot change, cleanly based on master.

Why

Automate regular dependency updates, and stop MaxMind geoip2 from being bumped to 5.x (which uses Java constructs incompatible with Android). Dependabot handles both — its ignore rule is the natural home for the MaxMind constraint, turning a fragile version pin into an enforced, documented rule.

Details

• Gradle (/) — weekly; minor/patch grouped into one PR, majors individually for review.
• Cargo (/wgbridge-rs, the gotatun bridge) — weekly; sensitive, so treat as informational PRs to test on-device before merging.
• GitHub Actions (/) — weekly; keeps checkout, setup-java, gradle/actions, cache current.
• MaxMind constraint:

  - dependency-name: "com.maxmind.geoip2:geoip2"
    versions: [">=5.0.0"]

  Usage is a single country-from-IP lookup (details/CountriesFragment.java), so nothing in 5.x is worth a fork. 4.x patch/minor still flow, and security updates bypass version ignores. An inline pin comment was added at the dependency so the rationale is visible in the build file.

Notes

• Nothing auto-merges — every bump is a reviewed PR. Version updates activate once merged to master.
• Dependabot alerts are already enabled on the repo; Dependabot security updates (the auto-fix PRs) are currently off in Settings → Code security — worth enabling so a transitive CVE in the pinned 4.x line still gets a PR.

🤖 Generated with Claude Code