build(deps): group Dependabot minor/patch updates into weekly PRs

[jhateley-godaddy]

Related issue

Fixes #83

Summary

• Add groups to both Dependabot ecosystems (gomod and github-actions) so minor and patch bumps arrive as one consolidated PR per ecosystem per weekly run, instead of one PR per dependency.
• Major version updates intentionally remain individual PRs so breaking changes get isolated review — relevant given the byte-for-byte wire contracts this repo maintains.
• Schedule was already weekly for both ecosystems; this change only adds grouping.

Notes

• On the first run after merge, Dependabot will close any currently open per-dependency PRs and re-open them as grouped PRs.

AI assistance

None

Checklist

• The PR title follows Conventional Commits — release notes are generated from it
• Tests cover the change
• The linked issue above uses a closing keyword
• Every commit is signed off (git commit -s) certifying the DCO

[bchen-godaddy]

LGTM