Add GitHub dependabot to handle package updates

[elliot-100]

Dependabot script to raise PRs to update outdated packages (and Github Actions that follow GitHub repository syntax) monthly.

@Olen I can adjust to e.g. weekly if you prefer.

This won't do anything until enabled in the GitHub interface; I'll note that in #87.

[Olen]

Monthly might be a bit long? Do you have any experience or know best practices from other projects?

[elliot-100]

I tended to use weekly in other projects, but it became tedious with dependencies on packages like ruff with very frequent releases.

But we don't have that here, and anyway that issue is better handled with the tools that Dependabot gives you to ignore updates for a version or package: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates#managing-dependabot-pull-requests-with-comment-commands

So I have adjusted to weekly here.