Modernise the dependabot configuration

Adds the github-actions ecosystem next to composer, moves from daily to
weekly, prefixes the commit messages by scope and widens version constraints
instead of pinning them.

The file keeps the name dependabot.yml. It had arrived as dependabot.yaml,
which GitHub does not read - where a dependabot.yml was already present the
new settings would have had no effect at all.

Author: zonky2