Create dependabot.yml

[andresailer]

BEGINRELEASENOTES

• Add dependabot.yml to allow automatic updates for github actions

ENDRELEASENOTES

[tmadlener]

This is a good idea. We will have to see how this interferes with our other tooling (see inline).

[tmadlener]

Can we have multiple directories here, resp. will this descend into e.g. https://github.com/key4hep/key4hep-actions/tree/main/workflows

I am asking because otherwise we will potentially have a ton of "stale by definition" PRs from the shared key4hep build action workflows that we distributed differently.

Or alternatively, can we exclude on file name patterns?

[andresailer]

Right, if these files are centrally managed, then we don't need a central dependabot.yml. We maybe just need one in edm4hep?

[tmadlener]

Yeah maybe. But that then has the disadvantage that it will probably still try to update the centrally managed ones unless there is a way of excluding certain files.