chore(deps): keep npm dependency updates to one PR if non-breaking

the npm package ecosystem releases all the time and it clutters up the
PR queue for mostly meaningless dependency updates

dependabot has a new "groups" feature to group dependency update PRs
together in to one PR based on either name globs, update types, or
dependency type

this should allow us to get all non-breaking changes through in single
PRs, while breaking (semver-major) changes will get individual PRs for
more detailed consideration

https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#groups

.github/dependabot.yml

@@ -23,5 +23,10 @@ updates:
     time: "10:00"
   open-pull-requests-limit: 10
   target-branch: dependency-updates
+  groups:
+    non-breaking:
+      update-types:
+        - "minor"
+        - "patch"
   labels:
   - "dependencies"