Add root-level `ignore: [{dependency-name: "*"}]` for the uv
ecosystem, missed in PR guacsec#431. Remove redundant per-directory entries
for ecosystems covered by root-level ignore-all. Replace glob
patterns with explicit directory listings for maven test fixtures,
since `/**` globs don't reliably match nested subdirectories for
security updates.

Add test fixture guidance to CONVENTIONS.md.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

## Summary
- Add root-level `ignore: [{dependency-name: "*"}]` for the uv ecosystem
(missed in PR #431)
- Remove redundant per-directory entries for ecosystems covered by
root-level ignore-all
- Replace `/**` glob patterns with explicit directory listings for maven
test fixtures
- Add test fixture dependabot guidance to CONVENTIONS.md

## Context
PR #431 added root-level ignore-all for npm, pip, gomod, gradle, cargo
but missed `uv`, causing Dependabot to create security PRs for
pyproject.toml files in test fixtures (#439, #440, #441). Glob patterns
are replaced with explicit paths since `/**` doesn't reliably match
nested subdirectories for security updates.

## Test plan
- [ ] Verify uv security PRs (#439, #440, #441) are closed by Dependabot
- [ ] Verify no new security PRs appear for test fixture directories
- [ ] Verify production maven dependency updates still work normally

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary by Sourcery

Update Dependabot configuration to correctly suppress updates for test
fixtures while preserving production maven updates, and document project
coding and Dependabot conventions.

Bug Fixes:
- Add root-level ignore-all entry for the uv ecosystem so Dependabot
does not open security PRs for uv-based test fixtures.

Enhancements:
- Simplify Dependabot configuration by relying on root-level ignore-all
entries for non-maven ecosystems and consolidating cargo configuration.
- Restrict Dependabot handling of maven test fixtures to an explicit
list of fixture directories to ensure they are not updated while keeping
production maven updates active.

CI:
- Adjust .github/dependabot.yml to correct ecosystem entries and
explicitly list maven test fixture directories for suppression.

Documentation:
- Add CONVENTIONS.md to document coding standards, dependencies, and
guidance for managing Dependabot suppression of test fixtures.

---------

Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>