Add dependabot.yml to reduce manual work

[birkskyum]

I noticed these recent commits:

• bump sass #7096
• bump polybooljs #7097
• bump npm-link-check #7098

This PR adds a dependabot that'll automate the bumping of minor/patch versions to keep them up to date, with release notes etc. (example here), so that the only work left for maintainers is to merge.

It'll not bump major versions of deps, which could lead to breaking changes.

There will be at most 1 open pr. per lockfile (so two, root+stackgl) with current settings.

It'll not auto merge unless this github workflow is also added. We actually do auto merge in maplibre, because the CI is the bar it has to meet anyway, and it's honestly quite a relief to be able to focus on the areas that needs attention.

[archmoj]

Thanks very much @birkskyum for this PR.
To avoid potential merge conflicts from various dependencies namely webpack with the esbuild PR, I prefer to merge this after #6909 is merged.

[birkskyum]

that makes sense - looking forward to the esbuild setup, it feels quite productive.

[birkskyum]

And just to clarify, it'll not make any conflicts unless the PRs are manually merged, and it's set to open max 2.

[archmoj]

Thanks very much for the PR.