Enable Dependabot for GitHub-actions versions

Treat GitHub Actions like any other dependency

GitHub already ships a dependency‑scanner for workflow files, so you can let Dependabot (or Renovate) watch for new Action releases exactly the way you let npm‑check‑updates watch your package.json.

```
# .github/dependabot.yml
version: 2
updates:
- package-ecosystem: "github-actions" # tells Dependabot to parse .yml workflows
directory: "/" # root of the repo
schedule:
interval: "weekly" # daily / weekly / monthly
open-pull-requests-limit: 5
# optional: only alert on new major versions (v→v+1)
allow:
- dependency-type: "direct"
ignore:
- dependency-name: "actions/checkout"
update-types: ["version-update:semver-patch", "version-update:semver-minor"]
```

What it does
• Every week Dependabot scans .github/workflows/*.yml.
• If a new major of actions/checkout (or any other Action you pin) is published, Dependabot opens a PR that bumps @v4 → @v5.
• The PR shows the release notes; you merge after testing.