Dependabot github-actions glob still targets the pre-flatten terraform/files layout

`.github/dependabot.yml` still points its `github-actions` ecosystem at the pre-flatten layout, so it currently matches nothing.

```yaml
- package-ecosystem: github-actions
directories:
- /
- /terraform/files/*/.github/workflows
```

The layout was flattened in #12 (`refactor: flatten layout to terraform//_config.json`), which moved `terraform/files//` to `terraform//`. The groups are now `terraform/root`, `terraform/alz`, `terraform/canary-ring-0`, and `terraform/canary-ring-1`, so `/terraform/files/*/.github/workflows` resolves to no directory.

The practical effect is that the actions pinned by SHA in the managed workflows are never proposed for update. For example `terraform/root/.github/workflows/codeql.yml` pins:

- `actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3`
- `github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2`
- `github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2`

`terraform/root/.github/workflows/dependabot-precommit.yml` pins `actions/checkout` as well, and #16 adds a pinned `actions/github-script`. None of these are covered today, so they are pinned but not maintained.

The fix is to update the glob to the current layout:

```yaml
- /terraform/*/.github/workflows
```

Worth confirming at the same time whether the existing `dependencies` / `github-actions` labels on that ecosystem still line up with the exclude list in `terraform/root/.github/release.yml`.

Found while reviewing #16.

Start by reading .github/dependabot.yml and compare its github-actions directories with the current terraform/*/.github/workflows paths named in the issue. Then inspect terraform/root/.github/release.yml to confirm the dependencies and github-actions labels still match its exclude list. Done means the current workflow directories are covered and the labels remain consistent.

Written by the indexing model from the issue text.