ci: automate 3rd party GitHub Actions version updates

[dimaqq]

fixes #1216

[dimaqq]

@benhoyt I don't have access to this repo settings, here's how to enable dependabot: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates#enabling-dependabot-version-updates

[tonyandrewmeyer]

Works for me, although maybe we want to extend this and switch dependabot from security only to all deps more generally?

[benhoyt]

Fine with me. I'd also be happy to add for other deps, as long as it's not noisy (for docs deps, for example, it just doesn't add much value): at most once a week.