Use dependabot to bump Python dependencies automatically

[antonymilne]

As a team we spend way too much time bumping Python dependencies, e.g. #804, #813, #726, #791.

Dependabot is already running and apparently doing a good job tracking JS dependencies. Let's do the same for Python. There's several places in kedro-viz which have Python requirements listed. I suggest we start by trying this out for the most important one, and if that works well we can extend to the lower priority ones. Starting with the most important, the order would be:

• package/requirements.txt
• package/test_requirements.txt
• demo-project requirements

We should really have the test suite running for all different versions of Python for this to work properly, i.e. #812 should be completed. It's fine to configure dependabot first and see what PRs it raises but I would be wary about blindly accepting/automatically merging them PRs until we have more a thorough CI setup.

[datajoely]

Love this - wonder if it could work for core too?

[antonymilne]

Yeah, that would be great. I was going to try it out on kedro-viz first given it's a simpler set of requirements, and if it goes well here then we should definitely give it a go on kedro too. We spend even more time managing dependencies there.

[datajoely]

Interested to see if it can handle fsspec et al switching to cal ver