fix(security): widen Dependabot scope and pin patched Next for webpack plugin

Remove dependabot.yml allow list so security updates are not limited to
@codecov/rollup-plugin.

Add next ^14.2.25 as a devDependency of @codecov/nextjs-webpack-plugin so
pnpm resolves a patched 14.x for the peer range instead of vulnerable 14.2.10.

Made-with: Cursor

Author: thomasrockhu-codecov

.github/dependabot.yml

@@ -7,5 +7,3 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "daily"
-    allow:
-      - dependency-name: "@codecov/rollup-plugin"

packages/nextjs-webpack-plugin/package.json

@@ -57,6 +57,7 @@
     "@vitest/coverage-v8": "^2.1.9",
     "codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
     "msw": "^2.7.0",
+    "next": "^14.2.25",
     "ts-node": "^10.9.2",
     "typedoc": "^0.27.5",
     "typescript": "^5.3.3",