Add Dependabot configuration for pip and GitHub Actions

[hakonhagland]

Add Dependabot configuration for pip and GitHub Actions

Follow-up to #27. That PR cleared 23 open Dependabot alerts in a single batch; this one is about not getting into that situation again.

The repository has no .github/dependabot.yml, which means GitHub only ever raises security alerts — it never opens routine version-update pull requests. Nothing has been nudging the dependencies forward between advisories, so they drifted: idna was still on 3.7 and certifi on a 2024 bundle, and python_scripts.yml is pinned to actions/checkout@v3 and actions/setup-python@v4 while python_sphinx_docs.yml has long since moved to v4 and v5.

What the config does

• pip, rooted at /python/sphinx_docs — the directory holding pyproject.toml and poetry.lock. The pip ecosystem is what Dependabot uses for Poetry projects.
• github-actions, rooted at / — picks up the workflow action pins. Dependabot can only bump actions referenced by a version tag, so this manages actions/checkout and actions/setup-python; OPM/actions-poetry@master and OPM/github-pages-deploy-action@releases/v4 are branch refs and are left untouched.
• Monthly schedule, one catch-all group per ecosystem — so each ecosystem produces at most one pull request per month. Grouping is the important part: ungrouped, GitPython alone went through eight patch releases in the three weeks from 2026-07-21 to 2026-08-07, and each would have arrived as a separate pull request.

This affects scheduled version updates only. Security updates are unchanged — they are still opened immediately and individually whenever an advisory is published, regardless of the schedule here.

What to expect after merging

• The first github-actions PR should bump actions/checkout v3 → v4 and actions/setup-python v4 → v5 in python_scripts.yml, bringing it in line with the other workflow.
• The first pip PR will be substantial, and deliberately so: it is the upgrade set that Dependabot aug2026 #27 steered around, including sphinx 7.2.6 → 7.3.7, sphinx-versioned-docs 1.3.1 → 1.4, typer 0.9 → 0.27 and rich 13 → 15. Those sit in the execution path of the gh-pages docs build, so that PR deserves a local sphinx-versioned run before merging rather than a green-CI-and-merge.
• sphinx-rtd-theme will not appear in it. The ^1.3.0 constraint in pyproject.toml caps it below 3.x and Dependabot respects the manifest, so lifting that pin — and with it the docutils < 0.19 and sphinx < 8 ceilings it imposes — stays a separate, deliberate change.