Configure Dependabot security and version updates

### Description

Configure Dependabot to identify vulnerable dependencies already present in the repository and open controlled update pull requests for npm/pnpm packages and GitHub Actions. Establish a sustainable update cadence and review workflow that keeps dependencies current without overwhelming contributors.

### Action Items

- [ ] Confirm the dependency graph, Dependabot alerts, and Dependabot security updates are enabled.
- [ ] Add a dependabot.yml configuration for npm/pnpm dependencies and GitHub Actions.
- [ ] Choose an update schedule, pull-request limit, labels, and commit-message conventions appropriate for the team.
- [ ] Configure sensible grouping for non-security version updates to control pull-request volume.
- [ ] Confirm security updates remain timely and are not unintentionally delayed by version-update grouping.
- [ ] Verify Dependabot can open and update pull requests that trigger the existing Integration and Compliance workflows safely.
- [ ] Document how contributors triage, test, merge, defer, or dismiss Dependabot updates.
- [ ] Review the initial set of alerts and update pull requests; create remediation follow-ups where automatic updates are unavailable.

### Additional Information

Dependency review is intentionally out of scope for this Task. Dependabot provides ongoing remediation after vulnerabilities are discovered in dependencies already on the default branch.

Related: #740 hardens the Integration workflow that will validate Dependabot pull requests.