ci: enable dependabot updates for github actions

## Problem

The repo has no `.github/dependabot.yml`, so GitHub Actions versions are never updated automatically. Repo-level security alerts are enabled, but those don't cover Action version updates — that requires a Dependabot config file.

Our Action pins have already drifted apart as a result:

- `actions/checkout` is on `v4` in four workflows but `v6` in `update-catalog.yml`
- `actions/setup-python` is on `v5` in two places and `v6` in one

## Proposal

Add `.github/dependabot.yml` covering the `github-actions` ecosystem only. Application dependencies (`npm`, `pip`) are deliberately out of scope — they'd generate far more traffic and should be a separate decision.

Two details specific to this repo:

- **Explicit Conventional Commits prefix.** `check-pr-title.yml` runs every PR title through commitlint. Dependabot's default title for this ecosystem (`Bump actions/checkout from 4 to 6`) fails both `type-empty` and `subject-case`. Setting `commit-message.prefix: chore` produces `chore(deps): bump ...`, and `chore` is in our `type-enum` allowlist.
- **Grouped updates**, so the existing drift lands as one weekly PR rather than a burst of individual ones.

No extra `directories` entry is needed for the local composite action at `.github/actions/check-input-commit-message` — it's referenced by relative path and contains no third-party `uses:`.

## Out of scope

- `npm` and `pip` ecosystems
- Pinning Actions to commit SHAs instead of major tags