Workflow improvements: 🦁 set-env, and 🐯 python-3.9, and 🐻 dependabot, oh my!

[felddy]

🗣 Description

This PR changes three things:

• It bumps the build workflow Python version to 3.9.
• It enables weekly dependabot scanning for pip and github-actions.
• It replaces the deprecated set-env syntax with the new $GITHUB_ENV file.

💭 Motivation and Context

The motivation is two-fold:

• General care and feeding of our skeleton crop.
• Getting a more robust dependency management policy started for the cisagov organization. This should help mitigate some of the dependency bit rot we're starting to see in some of our projects. A normal cadence of dependency update PRs triggered by dependabot will also help us identify the repositories that are ripe for archiving to the permafrost vaults of Svalbard. 🏔️

🧪 Testing

I have verified in my own clone that dependabot will not be opening any PRs during its initial scan.

📷 Screenshots (if appropriate)

🚥 Types of Changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (causes existing functionality to change)

✅ Checklist

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.
• All new and existing tests passed.

[hillaryj]

✨

[dav3r]

[jsf9k]

Let slip the dogs of war.