tell dependabot not to update url dependency

[cdisselkoen]

Description of changes

I think this is the right syntax.

For reasoning why this change, see the notes in cedar-wasm/Cargo.toml:

Lock url (dependencies of cargo-lock) to 2.5.2 because they may introduce a dependency on a crate licensed under the Unicode 3.0 license in a future minor version, and we do not have explicit legal aproval to use that license.

[john-h-kastner-aws]

I just told it to @dependabot ignore url patch version on it's PR, so let's see what that look like after it rebases

[cdisselkoen]

Closing in favor of #1323