ci: Skip benchmarks for dependabot

[shahzadlone]

Relevant issue(s)

Resolves #1143

Description

We have to replicate all github secrets for dependabot, a quick get around I want to try is to see if we can just skip the benchmark workflow for dependabot. Can turn benchmarking back on if we decide we need that once benchmarking has been fixed/improved. Other than the benchmark secrets we have a token for code cov and a ssh deploy key for defradb, both of which have been replicated in dependabot secrets.

Tasks

• I made sure the code is well commented, particularly hard-to-understand areas.
• I made sure the repository-held documentation is changed accordingly.
• I made sure the pull request title adheres to the conventional commit style (the subset used in the project can be found in tools/configs/chglog/config.yml).
• I made sure to discuss its limitations such as threats to validity, vulnerability to mistake and misuse, robustness to invalidation of assumptions, resource requirements, ...

How has this been tested?

Will need to have a dependabot PR open to test if this actually works or not.

Specify the platform(s) on which this was tested:

• WSL - Manjaro

[orpheuslummis]

We prefer to run benchmarks.
Benchmarks are currently high variance making them not useful as a point estimate. That's a problem we will fix. Once that is fixed, hopefully in a matter of weeks, we will activate benchmarks on dependabot. To me it seems simpler to just activate them now via secrets instead of disabling them now and activating them later.

[shahzadlone]

We prefer to run benchmarks. Benchmarks are currently high variance making them not useful as a point estimate. That's a problem we will fix. Once that is fixed, hopefully in a matter of weeks, we will activate benchmarks on dependabot. To me it seems simpler to just activate them now via secrets instead of disabling them now and activating them later.

There are two problems with benchmarks right now:

1. the broken ci - due to benchstat update.
2. the variance issue.

By default the way dependabot is setup it will trigger the SHORT benchmark flow. So even if we do want to turn benchmarking on we can change that to FULL later.

Up till now I haven't seen us bump dependencies only after benchmarking, it seems like a "nice thing to have", but not something worth blocking dependabot usability.

[orpheuslummis]

LGTM but IMO I wish to re-enable it soon

[orpheuslummis]

One thing that we should consider disabling is codecov for dependabot