chore: group dependabot updates for actions and pip (#160)

* chore: group dependabot updates for actions and pip

- Group all GitHub Actions bumps (minor, patch, major) into one PR
- Group minor and patch pip bumps into one PR; major bumps remain
  ungrouped for individual review

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: change dependabot schedule day to wednesday

* ci: add comment_on option to security auditing action

* ci: switch dependabot Python ecosystem from pip to uv

uv ecosystem reads uv.lock directly, enabling Dependabot to raise PRs
for lockfile-pinned versions including security patches.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: lhoupert

.github/dependabot.yml

@@ -1,11 +1,11 @@
 version: 2
 updates:
   # Enable version updates for Python dependencies
-  - package-ecosystem: "pip"
+  - package-ecosystem: "uv"
     directory: "/"
     schedule:
       interval: "weekly"
-      day: "monday"
+      day: "wednesday"
       time: "09:00"
     open-pull-requests-limit: 10
     reviewers:
@@ -17,13 +17,20 @@ updates:
       include: "scope"
     cooldown:
       default-days: 7
+    groups:
+      uv-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+        patterns:
+          - "*"
 
   # Enable version updates for GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
-      day: "monday"
+      day: "wednesday"
       time: "09:00"
     open-pull-requests-limit: 5
     reviewers:
@@ -35,3 +42,11 @@ updates:
       include: "scope"
     cooldown:
       default-days: 7
+    groups:
+      actions:
+        update-types:
+          - "minor"
+          - "patch"
+          - "major"
+        patterns:
+          - "*"

.github/workflows/security.yml

@@ -22,5 +22,6 @@ jobs:
     - uses: developmentseed/action-python-security-auditing@8ebea22ea75dfba2244ed9883c2aa6cb4df8d9a9 # v0.6.0
       with:
         package_manager: uv
+        comment_on: blocking
         bandit_scan_dirs: 'src/eopf_geozarr/'
         artifact_name: security-reports