Configure automatic Dependabot updates

These will happen once month — security vulnerabilities will still be
patched immediately.

We ignore patch updates since Cargo handles this for us: it will
already use the latest SemVer compatible when people download the
library.

.github/dependabot.yml

@@ -0,0 +1,18 @@
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+ - package-ecosystem: github-actions
+ directory: /
+ schedule:
+ interval: monthly
+
+ - package-ecosystem: cargo
+ directory: /
+ schedule:
+ interval: monthly
+ ignore:
+ - dependency-name: "*"
+ update-types:
+ - "version-update:semver-patch"