Enable dependabot

I think we should consider enabling [dependabot](https://dependabot.com/).

I've been using it on a bunch of my own projects recently and it is brilliant. It'll keep an eye on our dependencies (node_modules) and create a pull request when a new version of any package is released.

It'll mean we end up with a bunch of pull requests to keep an eye on an manage, but I think it's worth it.

Any thoughts?

Start with the Dependabot link in the issue and inspect the repository's JavaScript dependencies in node_modules. Enable dependency monitoring so new package versions can generate pull requests; done when Dependabot is active for the repository and update pull requests are created as expected.

Written by the indexing model from the issue text.