Enable Dependabot for NuGet and GitHub Actions #35

Problem

CI already audits restored packages (dotnet list package --vulnerable) and reviews dependency diffs on PRs. It does not open its own PRs when a NuGet package or Actions pin goes stale. Dynamitey Community has weekly Dependabot for both ecosystems.

What this issue covers

• .github/dependabot.yml: weekly NuGet and GitHub Actions updates, grouped where that reduces noise, PR limit 5.
• No ignore list unless a license or analyzer pin requires one (this repo does not ship SonarAnalyzer.CSharp).

Acceptance

• Dependabot is configured for nuget and github-actions at /.
• New updates arrive as PRs rather than only as audit failures after someone happens to push.