Code security / Dependabot rules: allow to set rules declaratively in code instead of imperatively

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Feature description

Currently, one can use GitHub repository's GUI to set Security Dependabot rules regarding security alerts:

Is there a way to define these rules declaratively instead, for instance in `.github/dependabot.yml`, similar to pull request rules?

The issue names .github/dependabot.yml and asks whether security-alert rules can be declared there instead of configured through the GitHub GUI. No implementation file or test is identified, so begin by locating Dependabot configuration entry points and related tests. Done means defining a declarative rule shape and confirming those rules are parsed and applied to security alerts.

Written by the indexing model from the issue text.