ci: add dependabot for github actions

[bjohansebas]

According to this comment, dependabot will be used for now to update the GitHub actions as part of improving the scorecard.

cc: @expressjs/security-wg

[UlisesGascon]

Probably we want to include npm too like in this proposal https://github.com/expressjs/express/pull/5435/files

[wesleytodd]

I have gone through two rounds of enabling this then disabling it on projects I work on. They are very noisy and unless the project is being super actively worked on I find them less helpful and more noisy than necessary. Not blocking this per-se, but I think we should make it monthly at best if we are going to set these up.

[bjohansebas]

+1 on making it monthly for all repositories, and maybe I don't want to merge this until it's merged in Express, unless you want to try it here first and then in the other repositories.