Extend Dependabot coverage to all package manifests

[collinsadi]

.github/dependabot.yml covers root cargo, root npm, /frontend npm, and GitHub Actions — but not /sdk, /asp, /publisher, /relayer, /circuits (and its v2/v3 packages), the SDK example app, or the scanner's separate cargo workspace, each of which has its own lockfile.

Add ecosystem entries for every manifest.

Acceptance criteria:

• Every directory with a lockfile has a Dependabot entry.
• Grouping and cadence follow the existing frontend configuration.
• The supply-chain policy doc lists the covered manifests.