Dependabot ignores constraints in .yml and package.json, creating PRs for minor version updates

Nobody has claimed this yet.

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

npm

### Package manager version

_No response_

### Language version

_No response_

### Manifest location and content before the Dependabot update

link to file: https://github.com/radius-project/radius/blob/main/typespec/package.json

```json
{
"name": "radius",
"version": "0.1.0",
"type": "module",
"dependencies": {
"@typespec/compiler": "~0.60.0",
"@azure-tools/typespec-autorest": "~0.46.0",
"@azure-tools/typespec-azure-core": "~0.46.0",
"@azure-tools/typespec-azure-resource-manager": "~0.46.0",
"@azure-tools/typespec-providerhub": "~0.46.0",
"@typespec/http": "~0.60.0",
"@typespec/openapi": "~0.60.0",
"@typespec/rest": "~0.60.0",
"@typespec/versioning": "~0.60.0"
},
"private": true,
"author": "Radius Authors",
"license": "Apache-2.0"
}
```

### dependabot.yml content

link to file: https://github.com/radius-project/radius/blob/1f241e39854dc13523f4c486b7b4bd88d85828c1/.github/dependabot.yml#L31

```yaml
...
- package-ecosystem: "npm"
directory: "/typespec/"
schedule:
interval: "weekly"
groups:
typespec:
applies-to: version-updates
patterns:
- "*" # Matches all dependencies
update-types:
- "patch" # Only allow patch updates for regular version updates
```

### Updated dependency

From: "@azure-tools/typespec-autorest": "~0.46.0"
To: "@azure-tools/typespec-autorest": "~0.48.0"

### What you expected to see, versus what you actually saw

We referred to documentation [docs-configuration](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#example-3) and updated the package.json (using tilde) and the dependabot.yml configuration. Both files specify that only patch versions should be updated for dependencies under /typespec/ folder.
Expected: No PRs for dependencies in /typespec/ folder for major, minor version updates.
Actual: We see a new PR that came in today https://github.com/radius-project/radius/pull/8100/files with a suggestion to bump the dependency @azure-tools/typespec-autorest from version 0.46.0 to 0.48.0. [Dependabot PR link](https://github.com/radius-project/radius/pull/8100)
Pls advise if package.json/dependabot.yml needs further updates/this is a bug.

### Native package manager behavior

NA

### Images of the diff or a link to the PR, issue, or logs

[Dependabot PR link](https://github.com/radius-project/radius/pull/8100)

### Smallest manifest that reproduces the issue

```json
{
"name": "radius",
"version": "0.1.0",
"type": "module",
"dependencies": {
"@typespec/compiler": "~0.60.0",
"@azure-tools/typespec-autorest": "~0.46.0",
"@azure-tools/typespec-azure-core": "~0.46.0",
"@azure-tools/typespec-azure-resource-manager": "~0.46.0",
"@azure-tools/typespec-providerhub": "~0.46.0",
"@typespec/http": "~0.60.0",
"@typespec/openapi": "~0.60.0",
"@typespec/rest": "~0.60.0",
"@typespec/versioning": "~0.60.0"
},
"private": true,
"author": "Radius Authors",
"license": "Apache-2.0"
}
```

Start by reproducing the update with typespec/package.json and .github/dependabot.yml, then compare the generated change in PR 8100 with the documented patch-only configuration. Trace the npm update handling that evaluates the tilde constraint and update-types setting. Done means minor updates such as 0.46.0 to 0.48.0 are not proposed when only patch updates are configured.

Written by the indexing model from the issue text.