Add Dependabot configuration (pip + github-actions)

[thehrh]

I propose testing if and how Dependabot can help us with our dependency updates. The suggested file has been produced using copilot. Once it is merged, we should be able to trigger a manual first Dependabot run from the dependency graph.

• Adds .github/dependabot.yml to enable Dependabot version updates for pip (setup.py/setup.cfg) and GitHub Actions workflows.
• Schedule: weekly
• Notes: Git-based dependencies (VCS URLs) and conda environment files are not managed by Dependabot (need pinned requirements or pyproject.toml for improved updates)

[bleaktwig]

Good idea!

[thehrh]

Only the part pertaining to the release versions of workflow actions is working (see https://github.com/icecube/pisa/actions/runs/20785160926/job/59692527903). No PR was opened by Dependabot though because of the recent #888.

Getting the dependency detection and updating running requires more than what's in this PR, namely apparently a requirements.txt and requirements-dev.txt (e.g. auto-generated from a slightly modified setup.py), as well as a .python-version file (so that Dependabot doesn't just use a recent Python 3.14 release). I'm playing around with this in my personal fork currently, observing which pull requests are being opened for a given python version choice (https://github.com/thehrh/pisa-1), and I'm not sure yet whether it makes sense for pisa (at this point or generally).