ci: have Dependabot track GitHub Actions versions

[dhensby]

Problem

Dependabot was configured for npm only, so workflow action versions were never proposed for update. They had drifted to actions/checkout@v3 and actions/setup-node@v3 — far enough behind that GitHub was force-migrating them onto Node 24 and emitting a deprecation warning on every run:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v3, actions/setup-node@v3.

#274 had to bump them by hand. This stops that recurring.

Change

Adds a github-actions ecosystem block, matching the convention already used in tediousjs/node-mssql, tediousjs/setup-sqlserver and dhensby/readable-tokens:

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    commit-message:
      prefix: "ci"
    groups:
      github-actions:
        patterns:
          - "*"

Two deliberate choices beyond the bare minimum:

• Grouped (patterns: ["*"]) — action bumps arrive as one PR rather than one per action. With five uses: entries across the workflow, ungrouped updates would be noisy.
• commit-message.prefix: "ci" — this repo lints commits with @commitlint/config-conventional and releases with semantic-release on the conventionalcommits preset. ci is a valid type and is non-releasable, so action bumps won't cut a version.

Verification

• YAML parses, and the parsed structure has both ecosystems with the expected keys.
• ci confirmed valid against the repo's commitlint.config (@commitlint/config-conventional) and non-releasable under the preset: conventionalcommits in .releaserc.
• Diff is 10 added lines in .github/dependabot.yml; nothing else touched.

No action bumps are expected on the first run — #274 already moved everything to actions/checkout@v7 and actions/setup-node@v7, which are current.