Add dependabot for web dependencies

[samfreund]

Description

A decent chuck of the web dependencies for photon-client and the landing page are out of date. Instead of updating them by hand, we can use dependabot to update them automatically for us. This will also help us in the future, as we will get updates as new versions are released.

Meta

Merge checklist:

• Pull Request title is short, imperative summary of proposed changes
• The description documents the what and why
• If this PR changes behavior or adds a feature, user documentation is updated
• If this PR touches photon-serde, all messages have been regenerated and hashes have not changed unexpectedly
• If this PR touches configuration, this is backwards compatible with settings back to v2024.3.1
• If this PR addresses a bug, a regression test for it is added

[mcm001]

Are you sure this is the correct place for this file?

[you] can edit the default dependabot.yml configuration file that GitHub creates for you in the /.github directory of your repository

https://docs.github.com/en/code-security/getting-started/dependabot-quickstart-guide

[samfreund]

Are you sure this is the correct place for this file?

[you] can edit the default dependabot.yml configuration file that GitHub creates for you in the /.github directory of your repository

https://docs.github.com/en/code-security/getting-started/dependabot-quickstart-guide

Yea nope. Definetely not. I'm gonna be busy until 2100 prolly, but if someone else wants to fix it feel free.

[Gold856]

I'm not sure we're ready for this. We're still stuck on Vue 2.7 and I think a good chunk of dependencies are also tied down because of that. We may want to wait until someone does #885.

[samfreund]

Yeah, probably. We can still use it for the landing site webpage tho.

[samfreund]

And the docs.

[GrahamSH-LLK]

To be honest, I think the dependabot PR spam is more detrimental than positive

[samfreund]

To be honest, I think the dependabot PR spam is more detrimental than positive

If you want to be in charge of updating dependencies whenever new versions get released, we could do that too. Otherwise tho, it's better to use dependabot as it makes staying up to date a lot easier.