ci(dependabot): ignore major version updates

Dependabot's `groups`/`update-types` only controls how updates are
bundled into PRs, not whether PRs are opened. Major bumps that match no
group (e.g. zod 3→4, vitest 3→4) were still raised as individual PRs.

Add an `ignore` rule for `version-update:semver-major` to both the npm
and github-actions ecosystems so major bumps are reviewed and applied
manually.

Author: auxesis

.github/dependabot.yml

@@ -34,10 +34,13 @@ updates:
       type-definitions:
         patterns:
           - "@types/*"
-    # Major bumps stay un-grouped → one PR each, easier to review.
     ignore:
       # Catalog-managed; bump manually via pnpm-workspace.yaml + changeset.
       - dependency-name: "@cipherstash/auth"
+      # Major bumps are reviewed and applied manually, not by Dependabot.
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
 
   # ── GitHub Actions ─────────────────────────────────────────────
   - package-ecosystem: github-actions
@@ -60,3 +63,8 @@ updates:
         update-types:
           - minor
           - patch
+    ignore:
+      # Major bumps are reviewed and applied manually, not by Dependabot.
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major