Consolidate Dependabot updates into a single grouped pull request

[gfs]

Why

The repo has no dependabot.yml, so Dependabot falls back to default behavior: one pull request per vulnerable dependency. That is why there is currently a backlog of separate npm security PRs (#764 through #769), each needing its own review and merge. On top of that, every one of those PRs fails the required "Check Changelog Action" gate, because bot PRs never touch Changelog.md.

What this does

Adds .github/dependabot.yml that rolls dependency maintenance into as few PRs as possible:

• One PR for all version updates. npm, NuGet, and GitHub Actions are all assigned to a single all-dependencies multi-ecosystem group, so Dependabot consolidates every available update, across every monitored directory, into one weekly pull request instead of one per dependency.
• One security PR per ecosystem. Multi-ecosystem groups only cover version updates, so each ecosystem additionally declares a *-security-updates group with patterns: ["*"]. Advisory-driven bumps then arrive as a single grouped PR per ecosystem rather than one per advisory.
• open-pull-requests-limit: 1 per ecosystem as a hard cap, so nothing escapes the grouping even if a dependency somehow falls outside a group.
• Labels dependencies, no changelog, plus javascript / .NET / pipeline. The no changelog label already exists in this repo and is the documented skip label for tarides/changelog-check-action, so grouped dependency PRs now pass the changelog gate instead of always failing it.

Directories covered: /DevSkim-VSCode-Plugin and /DevSkim-VSCode-Plugin/client for npm, /DevSkim-DotNet (projects discovered through Microsoft.DevSkim.sln) for NuGet, and / for GitHub Actions.

Also: fixes the changelog versioning guidance

While writing the changelog entry for this PR I picked 1.0.88 by following .github/copilot-instructions.md, which says to take "the next patch version (increment last number by 1)". That turned out to be a version that had already shipped.

The real version is 1.0.<git height> from Nerdbank.GitVersioning, so incrementing the previous changelog entry is only correct when no other PR merges in between. It has not been correct for a while:

Commit	Version actually built	Changelog heading
da7c777 (#753)	1.0.88	[1.0.85]
17706a8 (#755)	1.0.89	[1.0.86]
fb2d676 (#763)	1.0.90	[1.0.87]

Because each entry increments from the previous (already wrong) one, the drift is permanent and grows. So this PR also updates .github/copilot-instructions.md to derive the heading from nbgv get-version -v SimpleVersion and to re-check it if the PR sits open while others merge. It also documents the no changelog label as the gate's escape hatch, which is what the Dependabot config now relies on.

This PR's entry is [1.0.95], confirmed via nbgv get-version against the branch head (main is currently at 1.0.94). If another PR merges before this one, that heading needs a bump.

Notes for reviewers

• Dependabot cannot merge different ecosystems into one PR through the ordinary groups key, which is why this uses the newer top-level multi-ecosystem-groups option. The config was validated against the published Dependabot v2 JSON schema, and the multi-ecosystem-group + groups: applies-to: security-updates combination is confirmed working in production configs such as shakacode/react_on_rails and dfinity/internet-identity.
• This also turns on version updates, which were previously off since there was no config. Expect the first grouped PR to be large, since it will carry every outdated dependency at once.
• nuget.config clears nuget.org in favor of a private Azure DevOps feed. If the .NET half of the group reports resolution errors in the Dependabot logs, that is the cause, and it would need a registries entry with credentials to fix. npm and GitHub Actions are unaffected.
• Schedule is weekly, Mondays at 06:00 UTC. Easy to switch to monthly if weekly still feels noisy.