dependabot for dependency management

dependabot supports the Maven package system since quite a while.
having dependabot scanning our dependencies would be great! because I think it went out of hand a looong time ago 😉
once every week would be sufficent, I think. thoughts @christophd? I will add an initial configuration if you'd like me to.

Start by reviewing the repository's Maven dependency layout and Dependabot's configuration requirements for Maven. Add a weekly dependency scan covering the project's Maven dependencies, then verify that the configuration is valid and would identify outdated dependencies.

Written by the indexing model from the issue text.