chore(deps): group security updates

[Radiergummi]

multi-ecosystem-groups covers version updates only. Security updates are not grouped by it, so every advisory arrives as its own pull request. Across the org that produced 73 open Dependabot PRs, 23 of them in one repo.

Adds a groups: block with applies-to: security-updates alongside the existing multi-ecosystem groups. The two are complementary rather than alternatives:

	Scope	Grouping
multi-ecosystem-groups	version updates	one PR across ecosystems
groups + applies-to: security-updates	security updates	one PR per ecosystem

Verified on port-builder that Dependabot accepts both in a single update entry: the returned job definition carried "multi-ecosystem-update":true and "dependency-groups":[...], with no schema error. The docs do not state whether they can be combined, so this was confirmed by observation rather than assumed.

For the template repos this also means every repo generated from them inherits the grouping.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JyPT81eVGwPZZPtQAxVaWy

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.