Restrict Dependabot Netty updates to patch versions only

[bhoradc]

Motivation and Context

Until we're ready to adopt Netty 4.2.x in the SDK, Dependabot's Netty group creates unmergeable PRs proposing 4.1.x → 4.2.x minor version jumps (e.g., #6941, #6878). These PRs sit unreviewed indefinitely and consume one of our 5 open PR slots.

Meanwhile, patch-level updates like 4.1.132 → 4.1.133 (which contain CVE fixes) are never proposed because Dependabot always targets the latest version (4.2.x).

Modifications

Add an ignore rule for io.netty:* that blocks semver-minor and semver-major updates. Dependabot will now only propose patch bumps within the current minor line.

Testing

Validated in private repo, Dependabot correctly proposed 4.1.132 → 4.1.133 and did not propose 4.2.x.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)

Checklist

• I have read the CONTRIBUTING document
• Local run of mvn install succeeds
• My code follows the code style of this project
• My change requires a change to the Javadoc documentation
• I have updated the Javadoc documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed
• I have added a changelog entry. Adding a new entry must be accomplished by running the scripts/new-change script and following the instructions. Commit the new file created by the script in .changes/next-release with your changes.
• My change is to implement 1.11 parity feature and I have updated LaunchChangelog

License

• I confirm that this pull request can be released under the Apache 2 license