Add Dependabot config for GitHub Actions

[wadells]

We have some 3rd party GitHub Actions we're pinning for determinism and security, however we'd also like these pinned actions to stay up to date in a controlled fashion. This PR adds Dependabot for Github actions.

For example of recent pinnings, see:

• Bump configure-aws-credentials to 3.0.1 #31045
• Pin tibdex/github-app-token action #31115

Initial reviewers are a mix of security and internal tools folks, chosen to triage the first couple rounds of updates. I plan on handling these mostly myself, but I'd like to keep the other folks aware.

I chose not to add a language group for these yet, as I'd rather deal with each update individually while we get GHA dependency management ship-shape.

Contributes to https://github.com/gravitational/SecOps/issues/403

Testing Done

I added a version of this in https://github.com/wadells/teleport. You can see an example PR it opened here:

wadells#15

[rosstimothy]

LGTM. Though I would make sure you have a group 1 and 2 reviewer in your reviewers list otherwise you'll have to ping additional people every week

[wadells]

LGTM. Though I would make sure you have a group 1 and 2 reviewer in your reviewers list otherwise you'll have to ping additional people every week

Good point. At least initially, I'd like to do a first pass on these to make sure they're sane and useful before escalating.

Once things have smoothed out in a couple weeks, I'll chat with @r0mant about getting the appropriate group 1 reviewers on here. @fheinecke and @camscale can cover group 2.