ci: add Dependabot for GitHub Actions version updates

[lhoupert]

Adds a .github/dependabot.yml configuration with a github-actions ecosystem entry.

Dependabot will automatically open PRs to keep pinned SHA digests up-to-date as new versions of Actions are released, following up on the pinning done in #68.

---

Generated by ds-security-scanning zizmor-cli-unpinned-uses

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.32%. Comparing base (43174a1) to head (638adb0).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #69      +/-   ##
==========================================
- Coverage   98.47%   98.32%   -0.15%     
==========================================
  Files          21       21              
  Lines         981     1015      +34     
  Branches      130      134       +4     
==========================================
+ Hits          966      998      +32     
  Misses          7        7              
- Partials        8       10       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[maxrjones]

Thanks for these PRs @lhoupert!