dependabot: also watch for crates.io updates

[Ablu]

Config was copied from vhost, a866ed1d66f92a4119cdce18d767114e62948fae.

Requirements

Before submitting your PR, please make sure you addressed the following requirements:

• [x] All commits in this PR are signed (with git commit -s), and the commit message has max 60 characters for the summary and max 75 characters for each description line.
• [x] All added/changed functionality has a corresponding unit/integration test.
• [x] All added/changed public-facing functionality has entries in the "Upcoming Release" section of CHANGELOG.md (if no such section exists, please create one).
• [x] Any newly added unsafe code is properly documented.

[Ablu]

As discussed on Slack, turning this into a draft - while testing grouping on vhost-device (https://github.com/rust-vmm/vhost-device/pull/467). Will respin this with draft if it survived next week on vhost-device.