ci: add Dependabot version updates for Actions and BDD Python deps

[DavidCozens]

Purpose

Part of the repo security-and-quality hardening pass. Adds Dependabot version
updates so CI/test tooling stays current, complementing the Dependabot
security updates and secret-scanning push protection just enabled in repo
settings.

Change Description

.github/dependabot.yml watches, weekly:

• github-actions (/) — the CI, release-please, and SBOM workflows.
  Actions are SHA-pinned; Dependabot bumps the SHA and refreshes the version
  comment, reinforcing the action-pinning posture.
• pip (/Bdd) — the BDD harness Python requirements.

Docker is intentionally excluded — container images are bumped through the
deliberate chore: bump container image process (see docs/containers.md), and
Dependabot docker PRs would conflict with it.

Commit prefix is ci so bumps land as CI/tooling changes and don't trigger a
release.

Test Evidence

Config-only. dependabot.yml validated as well-formed YAML. Dependabot will
validate the schema on push and surface any errors on the repo's Dependabot
page.

Areas Affected

.github/dependabot.yml only. No source, build, or CI-behaviour changes.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added automated weekly dependency update checks for GitHub Actions and Python packages.
  • Limited automated update pull requests to five at a time for each package source.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2f7e6dc3-3c3f-44a0-a49f-a8e5f3047db1

📥 Commits

Reviewing files that changed from the base of the PR and between a0ae2f1 and a47d52f.

📒 Files selected for processing (1)

• .github/dependabot.yml

---

Walkthrough

Adds Dependabot configuration for weekly GitHub Actions and Python package version updates, scoped to / and /Bdd, with five open pull requests permitted per ecosystem and ci commit-message prefixes.

Changes

Dependabot updates

Layer / File(s)	Summary
Update schedules and pull-request limits .github/dependabot.yml	Configures weekly github-actions and pip version checks, their directory scopes, a five-PR limit, and ci commit-message prefixes.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is conventional, concise, and accurately summarises the Dependabot version-update change.
Description check	✅ Passed	All required sections are present and the rationale, scope, testing, and affected area are adequately covered.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/dependabot-config

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

☀️   Quality Summary

   🚦   build-linux-gcc: 100% successful (✔️ 1524 passed)
   🚦   build-freertos-host-tdd-plustcp: 100% successful (✔️ 1876 passed)
   🚦   build-linux-clang: 100% successful (✔️ 1455 passed)
   🚦   sanitize-linux-gcc: 100% successful (✔️ 1455 passed)
   🚦   integration-linux-openssl: 100% successful (✔️ 16 passed)
   🚦   integration-linux-mbedtls: 100% successful (✔️ 14 passed)
   🚦   integration-windows-openssl: 100% successful (✔️ 16 passed)
   🚦   bdd-linux-syslog-ng: 94% successful (✔️ 49 passed, 🙈 3 skipped)
   🚦   bdd-windows-otel: 88% successful (✔️ 46 passed, 🙈 6 skipped)
   🚦   bdd-freertos-qemu-plustcp: 87% successful (✔️ 45 passed, 🙈 7 skipped)
   🚦   bdd-freertos-qemu-lwip: 87% successful (✔️ 45 passed, 🙈 7 skipped)
   🚦   build-windows-msvc: 100% successful (✔️ 1300 passed)
   🚦   build-linux-tunable-override: 100% successful (✔️ 1455 passed)
   ⚠️   Clang-Tidy: No warnings
   ⚠️   CPPCheck: No warnings

---

Created by Quality Monitor v1.14.0 (#f3859fd). More details are shown in the GitHub Checks Result.

[github-actions]

☀️   Quality Summary

   🚦   build-linux-gcc: 100% successful (✔️ 1524 passed)
   🚦   build-freertos-host-tdd-plustcp: 100% successful (✔️ 1876 passed)
   🚦   build-linux-clang: 100% successful (✔️ 1455 passed)
   🚦   sanitize-linux-gcc: 100% successful (✔️ 1455 passed)
   🚦   integration-linux-openssl: 100% successful (✔️ 16 passed)
   🚦   integration-linux-mbedtls: 100% successful (✔️ 14 passed)
   🚦   integration-windows-openssl: 100% successful (✔️ 16 passed)
   🚦   bdd-linux-syslog-ng: 94% successful (✔️ 49 passed, 🙈 3 skipped)
   🚦   bdd-windows-otel: 88% successful (✔️ 46 passed, 🙈 6 skipped)
   🚦   bdd-freertos-qemu-plustcp: 87% successful (✔️ 45 passed, 🙈 7 skipped)
   🚦   bdd-freertos-qemu-lwip: 87% successful (✔️ 45 passed, 🙈 7 skipped)
   🚦   build-windows-msvc: 100% successful (✔️ 1300 passed)
   🚦   build-linux-tunable-override: 100% successful (✔️ 1455 passed)
   ⚠️   Clang-Tidy: No warnings
   ⚠️   CPPCheck: No warnings

---

Created by Quality Monitor v1.14.0 (#f3859fd). More details are shown in the GitHub Checks Result.