Enable dependabot

[clouserw]

Because

• We want to keep our dependencies up to date

This commit

• Enables Github's Dependabot support

Issue that this pull request solves

Closes: # (issue number)

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Any other information that is important to this pull request.

[clouserw]

I think this will enable dependabot, but the way I'm reading the docs is that we'll have to add a separate section for each package. I added a separate one for fxa-content-server just to see if my interpretation is right.

I didn't see a global open-pull-requests-limit which means that even if we made it 1 for each section we might still get overwhelmed with PRs when an update comes out.

I also added docker in here since they mentioned it, but I'm not sure it would be super useful to be honest. I suppose it wouldn't hurt.

Anyway.... r?

[dannycoates]

dependabot doesn't yet support yarn 2. we can revive this once it does

dependabot/dependabot-core#1297
dependabot/dependabot-core#2030

[clouserw]

We're going to try landing this. We think it will still open the PRs and we'll have to manually update the lock file. If it explodes, we'll turn it back off.

[dannycoates]

yolo