Dependabot ignores update-types.Updates everything regardles of groups or allowed types

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

nuget

### Package manager version

_No response_

### Language version

.Net

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

i have this config
version: 2

updates:
- package-ecosystem: "nuget"
directories:
- "/src/*"

schedule:
interval: "daily"
time: "08:00"
timezone: "Europe/Sofia"

commit-message:
prefix: "fix: "

allow:
# Microsoft packages: patch + minor
- dependency-name: "Microsoft.*"
update-types:
- "version-update:semver-patch"
- "version-update:semver-minor"

# All packages: patch
- dependency-name: "*"
update-types:
- "version-update:semver-patch"

ignore:
# Never create major version update PRs
- dependency-name: "*"
update-types:
- "version-update:semver-major"

groups:
microsoft-updates:
applies-to: version-updates
patterns:
- "Microsoft.*"
update-types:
- "patch"
- "minor"

all-other-nuget-patches:
applies-to: version-updates
patterns:
- "*"
exclude-patterns:
- "Microsoft.*"
update-types:
- "patch"

rebase-strategy: "auto"

### Updated dependency

fix: Bump 1nception.Serialization.NewtonsoftJson from 12.0.0 to 12.1.1
---
updated-dependencies:
- dependency-name: 1nception.Serialization.NewtonsoftJson
dependency-version: 12.1.1
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot]

### What you expected to see, versus what you actually saw

I expected only the packages whose names begin with Microsoft to be upgraded with minor versions and everything else to be patch only.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Start with the dependabot.yml configuration and the NuGet update described in the issue, then reproduce the behavior using the stated allow, ignore, and groups rules. Compare the generated update type and dependency selection with the expected Microsoft minor and non-Microsoft patch-only behavior; done means the resulting updates follow those rules.

Written by the indexing model from the issue text.