dependabot.yml for CI Docker and Github actions

[alan-forbes-cp]

First dependabot.yml file for version updates. By way of example it includes a simple initial configs for the existing CI Dockerfile and Github actions.
Associated repo UI config to enable dependabot is:

• Go to "Security (tab)/Code security and analysis (side tab)/Dependabot"
• Enable:
  • Alerts
  • Security Updates
  • Grouped Security Updates
  • Version Updates (for which dependabot.yml holds the config - Github should find the committed file)
  • Action Runners (soon to be mandatory)

Tailor the dependabot.yml file for additional package mangers as required. Similarly alert settings and some PR config can be set via the UI according to taste.

[carlewis]

@alan-forbes-cp I squashed both commits and added the label [CP-Sec] to the commit message, no changes added to the file itself.