Use dependabot to trigger rebuilds for osrf/ros2:testing

[ruffsl]

Using dependabot, we can automate the rebuilding of local docker images to be in lock step with that of respective parent images. We can do this by pinning the tag of the parent image to include the version identifier provided by the parent repo, and then configuring dependabot to watch the local manifest (or Dockerfile) for available version updates. This will subsequently open auto generate PRs to ratchet up the parent image tag when a newer version is pushed to the public docker registry upstream.

Upon merging changes to local Dockerfiles, existing github actions (#542) will trigger docker rebuilds of local image tags. The added build hook will also timestamp newly built image tags, allowing downstream projects building from our local images to use dependabot to similarly watch for updates to parent image tags.

Example dependabot PR:

• https://github.com/ruffsl/docker_images/pull/29

While the earlier beta version of dependabot provided a feature for auto merging dependabot PRs, this has been subsequently removed from the native integration offered by GitHub. While this feature can be replicated via third-party actions, it seems that much of this is still in flux due to migration and roadmap changes.

References:

• https://hugo.alliau.me/2021/05/04/migration-to-github-native-dependabot-solutions-for-auto-merge-and-action-secrets/
• Latest Dependabot Security Update broke this action  ahmadnassri/action-dependabot-auto-merge#89
• Support auto merge in Dependabot dependabot/dependabot-core#1973
• https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates