feat: add Dependabot config with grouping and a five-day cooldown - #13

Groups updates per ecosystem so one upstream release does not arrive as
three pull requests, with GitHub Actions kept separate because a workflow
bump changes what runs in the release path and deserves its own review.

Five-day cooldown on every ecosystem. This is a supply-chain control, not
a convenience: most malicious npm and PyPI releases in recent memory were
detected and yanked within hours, so waiting before adoption neutralises
that class of attack without anyone needing to be watching at the right
moment. Security updates are advisory-driven and ignore it.

Follows webapp's existing convention -- multi-ecosystem-groups, per-update
cooldown, `dependencies` label -- rather than inventing a second style.

Corrects a mistake in my earlier work. I documented the cooldown as coming
from the Renovate presets and warned against enabling Dependabot version
updates alongside them. But Renovate is not installed on the organisation:
there are zero Renovate pull requests across it, while Dependabot is
actively opening them and webapp already ships a dependabot.yml. So the
Renovate presets were describing a control that was not running, and the
warning had it backwards.

The presets stay, since they are valid and express the same policy for any
consumer that does adopt Renovate, but README and SECURITY.md now state
plainly that Dependabot is what runs here and that the presets require
installing the Renovate app.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CEdTd43qLEEE5qCsL1A7gW