fix(runtime): add dependabot config for gomod and github-actions (PILOT-368) (#6)

Add .github/dependabot.yml with weekly gomod and github-actions update
schedules, per the repo hygiene parent task PILOT-162.

Note: .github/workflows/notify-canary.yml is not included because
.github/workflows/** is in the agent paths_denied list. That part
requires operator or Hank to create separately.

Closes PILOT-368

Co-authored-by: Matthew Pilot <matthew-pilot@vulturelabs.io>

Author: matthew-pilot

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "go"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "ci"