feat: add Dependabot config with grouping and a five-day cooldown

[Radiergummi]

Grouped per ecosystem so one upstream release does not arrive as three pull requests, with GitHub Actions separate — a workflow bump changes what runs in the release path and deserves its own review.

Five-day cooldown on every ecosystem. This is a supply-chain control rather than a convenience: most malicious npm and PyPI releases in recent memory were detected and yanked within hours, so waiting before adoption neutralises that class of attack without anyone needing to be watching at the right moment. Security updates are advisory-driven and ignore it.

Follows webapp's existing convention (multi-ecosystem-groups, per-update cooldown, dependencies label) rather than inventing a second style.

Ecosystem	Directory	Why there
npm	/js	the only package that can live in a subdirectory
composer	/	Composer has no #subdirectory; Packagist reads the root
pip	/	pip install git+… and pre-commit expect root metadata
github-actions	/	every uses: is SHA-pinned; Dependabot bumps pins with the version comment intact

Corrects a mistake in my earlier work

I documented the cooldown as coming from the Renovate presets, and warned against enabling Dependabot version updates alongside them.

Renovate is not installed on the organisation. There are zero Renovate PRs across it, while Dependabot is actively opening them and webapp already ships a dependabot.yml. So the Renovate presets were describing a control that was not running, and my warning had it backwards.

The presets stay — they are valid and express the same policy for any consumer that does adopt Renovate — but README.md and SECURITY.md now state plainly that Dependabot is what runs here, and that the presets require installing the Renovate app.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.