Add Dependabot for Github actions

[pjonsson]

Description

Dependabot will submit pull requests
when packages get new versions released.
After merging this, Dependabot should
open pull requests that resolve the warnings
for the workflows in the actions tab,
as seen here for example:

https://github.com/CesiumGS/cesium/actions/runs/8487635213

Link to Dependabot documentation:

https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot

Issue number and link

Testing plan

Does not do anything to the repository/production code, only difference is that Dependabot will open pull requests for updating Github action versions after this is merged.

Author checklist

• I have submitted a Contributor License Agreement
• I have added my name to CONTRIBUTORS.md
• I have updated CHANGES.md with a short summary of my change
• I have added or updated unit tests to ensure consistent code coverage
• I have update the inline documentation, and included code examples where relevant
• I have performed a self-review of my code

[github-actions]

Thank you for the pull request, @pjonsson! Welcome to the Cesium community!

In order for us to review your PR, please complete the following steps:

• Send in a Contributor License Agreement (CLA)
• Add yourself to the contributors file

Review Pull Request Guidelines to make sure your PR gets accepted quickly.

[pjonsson]

I have signed the CLA and added myself to contributors (but I feel adding myself to contributors for a trivial thing diminishes the value of those who do the real work), not sure why github-actions bot is not updating the status.

[ggetz]

Thanks @pjonsson!

This update is scope just for dependabot to update action versions, not other dependencies, correct?

[pjonsson]

Yes, merging this PR will make Dependabot submit pull requests for outdated Github actions in .github/workflows. If you want Dependabot to submit pull requests for other eco-systems, that requires additional lines in the same file.

[ggetz]

Got it, thanks @pjonsson! We'll give this workflow a try.

[pjonsson]

@ggetz it looks like the PRs opened by dependabot were merged. Do you want me to look into getting dependabot configured for submitting PRs for updating nodejs dependencies for this repository?

[ggetz]

Not yet; though we may do so soon.