Configure dependabot to update the `uv` lock file

*See [parent issue](https://github.com/element-hq/synapse/issues/19566) for more context*

### Current state
`.github/dependabot.yml` uses `package-ecosystem: "pip"` with a comment explaining this is the correct ecosystem for Poetry-managed projects. It updates `pyproject.toml` and `poetry.lock`.

### Changes needed
- Change (or add alongside) the pip ecosystem entry to `package-ecosystem: "uv"` — [Dependabot supports uv natively](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem)
- Update the `allow`/`groups` configuration as appropriate
- The existing grouping strategy (minor+patch grouped, 10 open PR limit, 14-day cooldown) should likely be preserved