[dependabot-agent] Add Dependabot configuration for gomod and github-actions ecosystems

> [!CAUTION]
> Protected files were modified in this change.
> This pull request is in `request_review` mode and requires explicit human scrutiny before merge.
>
> Protected files: `.github/dependabot.yml`

## Dependency Release Train Summary

### What changed
- Package/ecosystem: n/a (adds automation, no dependency version bumped)
- Manifest(s): new `.github/dependabot.yml`
- Old version: no Dependabot config existed
- New version: adds `gomod` (root `/`) and `github-actions` (root `/`) ecosystems, weekly cadence, PR limit 5, actions grouped into one PR
- Update type: other (tooling/config)

### Why now
This repository has no `.github/dependabot.yml`. Repo evidence shows GitHub Actions references are already inconsistent and stale across hand-maintained workflows: `actions/checkout` mixes `v4` and a pinned `v6.0.2` SHA (latest is `v7.0.1`), `actions/setup-go` mixes `v5` and a pinned `v5.2.0` SHA (latest is `v7.0.0`), `actions/upload-artifact`/`download-artifact` are on `v4` (latest `v7.0.1`/`v8.0.1`), and `azure/login` is on `v2` (latest `v3.0.2`). `go.mod` currently declares zero dependencies, so `gomod` coverage is a no-op today but provides forward coverage as dependencies are added. Rather than hand-bumping many workflow files across many majors in one risky PR (which this run assessed as unsafe to bundle — different actions need independent major-version validation), this establishes automated, incremental, reviewable update PRs going forward.

### Risk assessment
- Runtime/dev/build/CI scope: CI-only (workflow tooling); no production runtime code touched.
- Direct/transitive: n/a — this is configuration, not a dependency bump.
- Reachability: n/a.

### Validation
- Commands run: `python3 -c "import yaml; yaml.safe_load(open('.github/dependabot.yml'))"` to confirm valid YAML/schema shape.
- Result: parses cleanly into the expected structure (two ecosystems, weekly schedule, grouped actions).
- Remaining gaps: Dependabot itself will only start producing update PRs after this config merges and its next scheduled run occurs; no live update PRs are generated by this change. gh-aw's own `*.lock.yml` files are generated (`DO NOT EDIT`) from their `.md` sources and are intentionally out of scope for direct Dependabot-authored edits — their pinned action SHAs are managed by the `gh aw compile` tooling instead, so this config targets only the hand-maintained root workflows.

Smart-Dependabot-Merge-Candidate: no (adds new automation surface; maintainer should confirm ecosystem scope/cadence before relying on it, not a dependency version bump)

### Control Plane
- Correlation ID: 34297352830-768
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34297352830

### Reviewer checklist
- [ ] CI passes
- [ ] CODEOWNERS or service owners reviewed
- [ ] Security-sensitive areas approved, if applicable
- [ ] Deployment/canary owner confirms runtime health, if needed

### Rollback guidance
- Revert this PR (single new file, no other files touched).

---

> [!NOTE]
> This was originally intended as a pull request, but the git push operation failed.
>
> **Original error:** The process '/usr/bin/git' failed with exit code 128
>
> **Workflow Run:** [View run details and download bundle artifact](https://github.com/githubnext/gh-aw-cao/actions/runs/34297352830)
>
> The bundle file is available in the `agent` artifact in the workflow run linked above.

Create the pull request manually

```sh
# Download the artifact from the workflow run
gh run download '34297352830' -n agent -D '/tmp/agent-34297352830'

# Resolve the bundle source ref, fetch it into a temporary ref, then create the local branch
bundle_path='/tmp/agent-34297352830/aw-github-gh-aw-threat-detection-dependabot-agent-add-dependabot-config.bundle'
temp_ref='refs/bundles/create-pr-dependabot-agent-add-dependabot-config-3b1a2d16'
target_ref='refs/heads/dependabot-agent/add-dependabot-config'
bundle_source_ref=$(git bundle list-heads "$bundle_path" | awk '$2 ~ /^refs\/heads\// { print $2 }')
if [ -z "$bundle_source_ref" ]; then
bundle_source_ref=$(git bundle list-heads "$bundle_path" | awk '$2 == "HEAD" { print $2 }')
fi
if [ "$(printf '%s\n' "$bundle_source_ref" | sed '/^$/d' | wc -l | tr -d ' ')" != "1" ]; then
echo "Expected exactly one bundle source ref, found: $bundle_source_ref" >&2
exit 1
fi
git fetch "$bundle_path" "${bundle_source_ref}:${temp_ref}"
git update-ref "$target_ref" "$temp_ref"
git checkout 'dependabot-agent/add-dependabot-config'
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d "$temp_ref"

# Push the branch to the target remote
git push 'origin' 'dependabot-agent/add-dependabot-config'

# Create the pull request
gh pr create --title '[dependabot-agent] Add Dependabot configuration for gomod and github-actions ecosystems' --base 'main' --head 'dependabot-agent/add-dependabot-config' --repo 'github/gh-aw-threat-detection'
```

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/34297352830) · copilot · auto · 113.7 AIC · ⌖ 13.5 AIC · ⊞ 21.1K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw-threat-detection+%22gh-aw-workflow-id%3A+dependabot-release-train-updater%22&type=pullrequests)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

Create the new .github/dependabot.yml file with the gomod and github-actions ecosystems described in the issue. Start by reviewing the existing root workflows and run the provided Python YAML parse command; done means the file parses cleanly and contains the requested weekly schedule, pull request limit, and grouped actions configuration.

Written by the indexing model from the issue text.