Add GitHub Actions to Dependabot updates

[justeph]

Updated Dependabot configuration to include GitHub Actions.

[luhenry]

Create a group to make sure we don't get spammed with PRs to update the versions: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#groups--

[justeph]

@luhenry , I am really not familiar with dependabot. Do you know if it's possible to update dependencies for all fiels but our .github/workflows/build-<package>.yml files?
I didn't find anything on how to do this.

I think we should not update thoses files (because we want to mirror upstream and because when merge and deploy we don't want to update the dependency and rebuild package unless a new version is available) what do you think? @luhenry @threexc

[threexc]

@luhenry , I am really not familiar with dependabot. Do you know if it's possible to update dependencies for all fiels but our .github/workflows/build-<package>.yml files? I didn't find anything on how to do this.

I think we should not update thoses files (because we want to mirror upstream and because when merge and deploy we don't want to update the dependency and rebuild package unless a new version is available) what do you think? @luhenry @threexc

I don't think it's necessarily bad if the packages do rebuild (provided they just do a deploy dry-run like in our normal PR workflow), since it might help us catch some problems with new action versions. There are a handful of packages (e.g. polars-runtime, grpcio, torch) which we'd want to exclude. I'm not immediately sure what the best way to exclude those in such situations would be.