chore(.github): dependabot group for all GH actions

[thehowl]

Continuing the work in #1553, this adds a dependabot group to update all GH actions together.

[kristovatlas]

Some limitations to note for reviewers: source

• Dependabot only supports updates to GitHub Actions using the GitHub repository syntax, such as actions/checkout@v4. Dependabot will ignore actions or reusable workflows referenced locally (for example, ./.github/actions/foo.yml).
• Docker Hub and GitHub Packages Container registry URLs are currently not supported. For example, references to Docker container actions using docker:// syntax aren't supported.

[kristovatlas]

If a change to dependabot.yaml breaks something, how will we observe this?

[kristovatlas]

untested but LGTM

[MichaelFrazzy]

Seems really useful! Do you see this including the user profile Actions/workflows as well? Essentially us trying to get all related tests/workflows running from the same .yml file and CI build?

As is I have a different .yml file for each action and script to be super sure during testing, but I can look into combining them all under this. All 3 use checkout@v2 so far through a Ubuntu actions/setup-python@v4 setup, sounds like the latter part could be an issue.

[thehowl]

If a change to dependabot.yaml breaks something, how will we observe this?

I tried looking up on the internet how we could solve this, and laughed out loud reading this SO answer:

The action mentioned seems to be fixed. I made a PR to add it: #1642.

[thehowl]

Do you see this including the user profile Actions/workflows as well?

Kind of unrelated here. This just tells dependabot to be less annoying and batch all PRs to update GH actions into one.

Essentially us trying to get all related tests/workflows running from the same .yml file and CI build?

Nah, that's unnecessary. Specifying different jobs, even if they have to re-do the same thing, is good because it allows the jobs to be easily parallelised by the runners.