Disable version updates for the mix ecosystem (#1562)

This prevents noisy PRs that bump versions from being opened by
dependabot, instead [only allowing security updates
through](https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates#overriding-the-default-behavior-with-a-configuration-file).

.github/dependabot.yml

@@ -9,6 +9,8 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
+    # Only allow security updates
+    open-pull-requests-limit: 0
   - package-ecosystem: "pip"
     directory: "/"
     schedule: