chore: add dependabot

[inigomarquinez]

Main Changes

dependabot will check for available updates for the dependencies that we use in the project. In the current setup, it will generate PRs once per week if the are new versions for our dependencies (npm and Github Actions).

We can remove npm and limit it to Github Actions, as well we can modify the frequency.

dependabot is capable of following the pin version schema introduced in #25, so it will be able to upgrade and pin the Github actions accordingly.

The configuration is very flexible, see the documentation

Context

• Ref: Implementing OSSF Scorecard expressjs/security-wg#2
• Report: https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/jshttp/statuses/commit/454ceb6e0bfea4f889be244de2538df8afb4dc2a

[UlisesGascon]

Thanks for the PR @inigomarquinez!

I will convert this PR to draft for now, as there is an ongoing discussion about dependabot role in the project in this PR: expressjs/express#5435. As soon as that conversation is resolved, we can revisit this one.