Enable github's Dependabot

[matthiasgoergens]

This PR enables automated dependency updates built into GitHub. That's useful for keeping up-to-date on security updates for example.

[epage]

I personally found Dependabot too noisy and taking up too much of my time. While RenovateBot was more work to get configured right, it has streamlined my process a lot.

e.g. the config I use with clap: https://github.com/clap-rs/clap/blob/master/.github/renovate.json5

[zackw]

As a user I urge you not to bump minimum version requirements without a compelling reason. "We are directly affected by a bug that was fixed in version N" is a compelling reason. "We can get rid of so much code if we require version N" might also be (depending on how big the pile is).

"A newer version happens to exist", however, is not a compelling reason.