Consider ways to make dependabot less noisy

Now that cargo.lock has been added, Dependabot now alerts about minor and patch version updates as well as major version updates. However, these pull requests come too frequently, distracting us from more important work.

There are a few options on how to fix this:

• Stick to the status quo by ignoring minor and patch releases (might have to be configure per-package): https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#update-types-ignore
• Change the frequency from daily to monthly (https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#required-keys)
• If possible, the frequency could potentially even be changed to quarterly (https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#interval)

Given the scope of Hypermine, a security vulnerability in an existing package is unlikely to result in danger to anyone playing Hypermine, and I could imagine that a more important security risk is that the private key of one of our dependencies' maintainers gets compromised, causing a malicious patch version for a trusted package to be uploaded to cargo. Such packages would be yanked very quickly, but if we are quicker, we could be affected. To keep this project low-maintenance, being slow about updating packages seems like the right move.

Start by reviewing the repository's current Dependabot setup alongside cargo.lock and the linked Dependabot options for update types and intervals. Compare the proposed policies and confirm the selected approach with maintainers; done means the configuration reflects an agreed policy that reduces unnecessary minor and patch update pull requests.