ci: enable Dependabot version updates for pnpm dependencies (#1887)

Part of #1732.

Adds the npm ecosystem (used by Dependabot for pnpm projects) to `.github/dependabot.yml`, replacing the TODO left in #1771.

- Weekly schedule with a 7-day cooldown, matching the GitHub Actions configuration.
- Patch updates are grouped separately for production and development dependencies; minor and major updates arrive one per PR.
- `@types/vscode` is ignored so that it keeps tracking the minimum supported VS Code API and is bumped together with `engines.vscode`.
- Major updates of `@types/node` are ignored so that it keeps tracking the Node.js version bundled with VS Code.
- Commits use the `chore:` prefix, so dependency bumps are skipped by git-cliff.

The repository uses pnpm 11 with a single-document `pnpm-lock.yaml`, which Dependabot supports (dependabot/dependabot-core#14794).

Author: eitsupi

.github/dependabot.yml

@@ -9,4 +9,29 @@ updates:
     cooldown:
       default-days: 7
 
-# TODO: node ecosystem config (#1732)
+  # pnpm projects use the npm ecosystem.
+  - package-ecosystem: npm
+    directory: /
+    commit-message:
+      prefix: "chore: "
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      # Bundle patch updates; minor and major updates still arrive one per PR.
+      dependencies:
+        dependency-type: production
+        update-types:
+          - patch
+      dev-dependencies:
+        dependency-type: development
+        update-types:
+          - patch
+    ignore:
+      # Tracks the minimum supported VS Code API; update with `engines.vscode`.
+      - dependency-name: "@types/vscode"
+      # Tracks the Node.js version bundled with the minimum supported VS Code.
+      - dependency-name: "@types/node"
+        update-types:
+          - version-update:semver-major