chore: schedule weekly composer and actions dependency updates

[bjalt]

There was no .github/dependabot.yml, so only security updates ran — nothing bumped dependencies routinely, which is
why PR #8 had to move the workflow actions off the deprecated Node 20 runtime by hand.

Adds two weekly updaters (Monday, Europe/Berlin):

• composer — symfony/* grouped into one PR, since the components release in lockstep. composer.json pins
  7.4.*, so this only ever offers patch releases inside the LTS branch; moving to 8.x stays a deliberate manual
  change.
• github-actions — all 7 pinned actions across both workflows, grouped. All are current today, so expect a quiet
  start; the value shows up at the next runner-runtime deprecation.

Both use commit-message.prefix: chore to match the repo's chore:/fix:/feature: convention rather than
Dependabot's default build(deps).

Verify

The YAML parses and the keys are well-formed, but GitHub only validates a Dependabot config once it is on the default
branch — there is no local or API validator. The real check is Insights → Dependency graph → Dependabot after merge:
both ecosystems should be listed with no config error.