feat: dependabot workflow automation for updating dependency

[Rajpratik71]

Signed-off-by: Pratik Raj Rajpratik71@gmail.com

[sudo-bmitch]

LGTM

[sparr]

I was surprised to see that "/" is the appropriate directory for the github-actions pacakge-ecosystem. https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#directory

[tianon]

Unfortunately, I'm personally NACK on this -- we're a Go library, and the version we choose for our dependencies puts constraints on every project who imports us, so auto-updating our Go dependencies is the opposite of what we should do, IMO.

See https://research.swtch.com/vgo-mvs for more details about Go's methodology on dependency versioning.

[sudo-bmitch]

I agree with Tianon on this one. I thought this was for the security updates, but we already have those enabled on the project. For other dependencies, that can be done on an as-needed basis.