Configure automatic Dependabot updates

These will happen once month — security vulnerabilities will still be
patched immediately.

We ignore patch updates since Cargo handles this for us: it will
already use the latest SemVer compatible when people download the
library.

.github/dependabot.yml

@@ -0,0 +1,18 @@
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: monthly
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-patch"