Add workflow to bump package after dependabot merge

[Odilhao]

I'd still argue for an approach where requirements.txt isn't strict, but rather pins to ranges, for example using pulp ~= 3.39.0 (which also allows installing 3.39.1). Then you'd install that and see if you need to update packaging. Otherwise requirements.txt goes out of sync with the rest of the repository all the time.

We have dependabot enabled now, and it's working to keep with z-streams of pulpcore and pulp-rpm, we need this due to VCRs on Katello that can get broken when we do major upgrades.

I'll refactor later this week and move from being one big script inside of YAML to one standalone script.

I do have plans to revive the _generate_deps.sh, unfortunately right now we have packages that still use setup.py and other that don't use it anymore or never used, and the spec generation is not straightforward in the dependency side. For now we will only focus on getting the core components of pulp up to date, to later implement as Foreman is doing right now.

[Odilhao]

@ekohl I think we are now in a better shape for another review. :smile:

[Odilhao]

Let me tag @evgeni as well, I heard that he loves GH-actions

[Odilhao]

Merging and YOLO