ci: add dependabot config

[consideRatio]

I find dependabot can be noisy if opening PRs daily, but i think weekly and monthly is fine. In this PR I'm adding a dependabot config to bump versions of github workflow's referenced actions.

This can be augmented with dependabot config to bump versions of python packages etc if we extract them to be listed in a requirements.txt / environment.yml file etc.

[martindurant]

@consideRatio , thank you for providing all of these CI improvements and generally for engaging in the repo. You are certainly the main contributor at this point, and I have invited you to be an admin on the repo. I'm not sure if you've been to any Dask monthly meetings, but it would be great if you were to introduce yourself and this work you've been doing. We will add you to the dask org, if you ilke.

@jcrist , I propose that, if @consideRatio accepts, that you grant them the PyPI and conda-forge rights, so that a release can happen. For the latter, there is already an open PR on the feedstock.

[consideRatio]

Thank you for your trust in me @martindurant! I'd be happy to join a meeting and introduce myself, I've added the next meeting (7th April) to my calendar.

I'd welcome the recognition of being invited to the dask org, but I don't consider myself constrained with maintenance work without such technical privileges as I would want to clearly confirm actions taken by other dask admins anyhow.

I figure a key point to note about my work with this project is that I'm an active Helm chart user / dask-gateway k8s backend user, but not a user of the other backends etc. I'm also not great with Golang and can mainly help out with other parts in this advanced repo that includes a lot of pieces. Due to that I hope that we can find people using dask-gateway together with the other supported backends to create dask clusters to help verify functionality associated with cutting releases.

[martindurant]

I don't consider myself constrained with maintenance work without

membership of the org is an horourific, and does not require anything more from you than you are doing :)

I'm an active Helm chart user / dask-gateway k8s backend user, but not a user of the other backends

Understood, but still you know much more than most. Since even HPC systems often have k8s as an alternative these days, that is probably the backend of choice for the future. But agreed that it would be nice if we could find those people making serious use of gateway o HPC and yarn.

[jacobtomlinson]

Strongly agree with everything @martindurant says. Thanks for all the hard work here @consideRatio.