Don't require changelog for dependabot

[DMRobertson]

One way to deal with #496.

Pull Request Checklist

• [ ] Pull request includes a changelog file. The entry should:
  • Be a short description of your change which makes sense to users. "Fix a bug that prevented receiving messages from other servers." instead of "Move X method from EventStore to EventWorkerStore.".
  • Include 'Contributed by Your Name.' or 'Contributed by @your-github-username.' — unless you would prefer not to be credited in the changelog.
  • Use markdown where necessary, mostly for code blocks.
  • End with either a period (.) or an exclamation mark (!).
  • Start with a capital letter.
• [ ] Pull request includes a sign off

[richvdh]

This feels kinda wrong? We ought to have changelog entries for such things?

[anoadragon453]

Blocked on resolving the internal discussion on the mailing list around what we want to do -- though it looks like we're leaning towards including a changelog.

[DMRobertson]

Conclusion:

• we'll manually add a changelog for now.
• we won't update pyproject.toml, just the lockfile.