Dependabot automatically files PRs for updatable dependencies. As
configured it watches all workflow files in `.github/workflows` for
possible updates to any of the Actions depended upon.
We specifically do not enable Dependabot for other things, in order to
avoid running in a hamster wheel.
Closes#2315
