Dependabot automatically files PRs for updatable dependencies. As configured it watches all workflow files in `.github/workflows` for possible updates to any of the Actions depended upon. We specifically do not enable Dependabot for other things, in order to avoid running in a hamster wheel. Closes #2315