chore: add dependabot and update github actions

Closes #1756

- [x] update github actions to latest versions
- [x] use SHAs instead of tags for github actions, more secure supply chain
- [x] add dependabot file grouping minor/patch dependency updates to reduce PRs

Signed-off-by: jmeridth <[email protected]>
Co-authored-by: Zack Koppert <[email protected]>

Author: jmeridth

Diff for: .github/dependabot.yaml

@@ -0,0 +1,39 @@
+---
+version: 2
+updates:
+  - package-ecosystem: 'bundler'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+    commit-message:
+      prefix: 'chore(deps)'
+    groups:
+      dependencies:
+        applies-to: version-updates
+        update-types:
+          - 'minor'
+          - 'patch'
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+    commit-message:
+      prefix: 'chore(deps)'
+    groups:
+      dependencies:
+        applies-to: version-updates
+        update-types:
+          - 'minor'
+          - 'patch'
+  - package-ecosystem: 'docker'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+    commit-message:
+      prefix: 'chore(deps)'
+    groups:
+      dependencies:
+        applies-to: version-updates
+        update-types:
+          - 'minor'
+          - 'patch'

Diff for: .github/workflows/ci.yml

@@ -19,21 +19,21 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           fetch-depth: 10
 
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@v3
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
 
-      - uses: actions/setup-python@v2
+      - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5
         with:
           # This should match lib/github/markups.rb GitHub::Markups::MARKUP_RST
           python-version: '3.x'
 
-      - uses: actions/cache@v2
+      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip