Make dependatool respect configs for parent folders

Especially now that dependabot has grown grouping fun it would be handy not to have to configure every package set individually

I think my hesitation is that we need to figure some rules for it otherwise a single config in the root of the repo would automatically cover everything - which is not generally what we want