Enable dependabot

[alan-strohm]

We don't have a lot of dependencies (just go-cmp and the GitHub actions), but it's recommended internally and by the security scorecard

Detailed instructions:

Enable Dependabot on all org repositories. (Renovatebot is acceptable if you’re already using it.)

First create a dependabot.yml config file to allow updates for dependencies. (You can use this template for the config file.) Place the config file under the .github/ folder.
Then enable the settings, selecting options to enable Dependabot alerts and security updates. Also enable secret scanning if available.

[panmari]

Fixed by #155