Set up dependabot configuration for pip

[weiji14]

Enable dependabot to manage python dependencies pins for a more stable CI.

References:

• https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates

Closes #488

[adamjstewart]

Pushed a commit so that dependabot actually has something to update (requirements.txt) and we actually use it in CI. Remaining TODOs:

• Solve version compatibility issues (latest version of numpy doesn't support oldest Python)
• Make sure docs still render correctly (pytorch_sphinx_theme is very finicky about how it is installed: Missing fonts pytorch/pytorch_sphinx_theme#143)
• Figure out how to use requirements.txt to control version of deps installed by conda
• Figure out how to only install a subset of deps for different tests (Install only the needed lint tool in style checks CI #553)
• Figure out why black is being installed with notebook support, if we can disable that, or fix notebooks

[adamjstewart]

I think this is ready for review. Some caveats to be aware of:

1. pytorch-sphinx-theme has no official releases, so we're at the whims of the master branch. It also can't be specified anywhere other than docs/requirements.txt so that's fun: Missing fonts pytorch/pytorch_sphinx_theme#143. We should consider switching to trojanzoo_sphinx_theme, but we can do that in a separate PR.
2. I haven't figured out an easy way to control the conda-installed packages with dependabot. For now, we can just manually update .github/workflows/tests.yaml every time fiona or rasterio has a new release. We could try to call grep on requirements.txt and use the output to specify the version for conda to install, but honestly it might be easier and more worthwhile to just add wheels to fiona and rasterio.
3. NEP-29 is fun. If we want to continue to support Python 3.7 (I do), then we need to specify Python version-specific versions for all dependencies that subscribe to NEP-29's philosophy. I have no idea how dependabot will handle these. We can ignore them if we need to.
4. I don't know how this will interact with Add upper bounds to all dependencies #544. I think dependabot will continue to update versions and ignore setup.cfg, so we have to be careful to update that ourselves whenever a new major version is released.
5. All tests now install all dependencies. This is unfortunate because I really liked the idea of Install only the needed lint tool in style checks CI #553. There are open issues requesting support for multiple requirements.txt files, but no progress yet. I wonder if poetry would solve any of these issues?

TL;DR: This isn't perfect, but I think it will solve most of our frequent CI issues. We should merge this and see how annoying it is. If it's more trouble than it's worth, we can revert it or see if poetry makes things easier.

[calebrob6]

This all seems fine to me. Why run black on notebooks here?

[adamjstewart]

For some reason black was being installed with jupyter support by default now. I could figure out how to disable it, but I figured it would be easier to just run it on our notebooks.

[adamjstewart]

Hmm, why is dependabot listed as a TorchGeo contributor? How do I remove him before he becomes the primary developer of TorchGeo? 😆