Add dependabot.yml

[andy5995]

This will cause dependabot to open PRs to bump any actions, such as "checkout" when never major versions are released.

https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file

[elextr]

when never major versions are released

Are you saying Geany will never get another major version 😉

@b4n @eht16 release specialists, any comment?

[andy5995]

when never major versions are released

Are you saying Geany will never get another major version 😉

Hehe, looks like I did bad typing again. ;)

An example is here where it was merged into the curl project on Jan 2.

And then dependabot opened a PR to bump the version of various actions (The PR shows "closed" but that's because the curl project has a different way of merging things; you can see here that it was merged curl/curl@dfe34d2 )

[eht16]

Yeah, why not.

Two remarks:

• why Docker?
• Automatic updating of the action versions won't work directly as we pinned the actions and their versions in the organization settings. I think this is useful to reduce the risk of getting unwanted actions or code executed in CI.
  So even after merging Dependabot's PRs, a Geany admin still has to do allow that action/version in the settings for security reasons.

[andy5995]

K, I removed the docker section.

[eht16]

Thanks!