Consider a maintenance strategy for the Dependabot PR backlog

There are currently several open Dependabot pull requests that have accumulated without being merged or otherwise resolved.

Some of them are routine dependency updates, but others can also affect security findings in the current dependency graph. For example, #1081 updates Testcontainers to 4.14.0, which includes the SSH.NET dependency update addressing the vulnerability that is currently also visible in downstream builds.

Would it make sense to define a more explicit maintenance strategy for Dependabot PRs?

Possible approaches could include:

* periodically reviewing and merging passing Dependabot PRs;
* automatically merging passing patch/minor dependency updates where appropriate;
* keeping major updates subject to manual review;
* prioritizing dependency updates that resolve known security advisories;
* grouping related dependency updates to reduce the number of individual PRs.

The goal would not be to automatically accept every dependency update, but to prevent dependency PRs from accumulating indefinitely and to make security-related updates easier to get into `main`.

Would such a maintenance policy be useful for this repository?

Start by reviewing the open Dependabot pull requests, especially #1081, and the security impact described in the issue. Done means reaching agreement on an explicit maintenance policy for routine, major, grouped, and security-related updates and documenting or applying that decision to the backlog.

Written by the indexing model from the issue text.