chore: exclude test fixture manifests from Dependabot

The src/test/resources/tst_manifests/ directory contains intentionally
pinned (and sometimes vulnerable) dependencies used as test data.
Dependabot was raising version and security update PRs for these
fixtures, which should never be upgraded automatically.

Add ecosystem entries for npm, pip, gomod, gradle, and cargo with
exclude-paths covering src/test/** and open-pull-requests-limit: 0
so Dependabot skips those manifests entirely for version updates.

Note: exclude-paths does not apply to Dependabot security updates.
Security update PRs for test fixtures must be closed manually and
their alerts dismissed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ruromero

.github/dependabot.yml

@@ -10,3 +10,41 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+  # Prevent Dependabot from scanning test fixture manifests.
+  # These contain intentionally pinned (and sometimes vulnerable)
+  # dependencies used as test data for the dependency-analysis client.
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - "src/test/**"
+    open-pull-requests-limit: 0
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - "src/test/**"
+    open-pull-requests-limit: 0
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - "src/test/**"
+    open-pull-requests-limit: 0
+  - package-ecosystem: "gradle"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - "src/test/**"
+    open-pull-requests-limit: 0
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - "src/test/**"
+    open-pull-requests-limit: 0