chore: add dependabot config

[jmeridth]

• [x] add dependabot config
  • group dependency updates when minor/patch to reduce PRs
  • keep major dependency updates separate for visibility and testing
• [x] change workflow actions to SHAs instead of tags to secure supply chain
  • tags are mutable and malicious code could be injected, SHAs are immutable
  • format workflows
  • used frizbee locally to do this
  • frizbee ghactions -d .github/workflows

[rmosolgo]

Thanks for these improvements!