chore: add dependabot configuration for dependency updates

[cmonney]

What changed

Why

How it was tested

ADR impact

Checklist

• All tests pass locally (dotnet test)
• dotnet format --verify-no-changes produces no output
• No new warnings have been introduced (build with TreatWarningsAsErrors)
• An ADR has been created or updated if an architectural decision was made
• The runbook has been reviewed and updated if the cutover sequence or rollback procedure changed
• ROADMAP.md has been updated if an MVP item has been completed or a Phase 2 item has changed scope
• UK English is used throughout (documentation, comments, identifiers where practical)