Group dependabot updates of GHA

.github/dependabot.yml

@@ -15,10 +15,23 @@ updates:
       # mainly upgrading to ensure we keep up with the Rust requirements of
       # dependencies.
       interval: quarterly
+    groups:
+      # avoid getting bombarded with single-update PRs each quarter
+      gha-bump:
+        applies-to: version-updates
+        update-types:
+          - "patch"
+          - "minor"
   - package-ecosystem: cargo
     directory: /
     schedule:
       interval: daily
+    # already the default for libraries, but we want it for everything
+    # unfortunately it's rejected in dependabot.yml at the moment despite being
+    # implemented inside dependabot. see
+    # https://github.com/dependabot/dependabot-core/issues/4009
+    #
+    # versioning-strategy: "increase-if-necessary"
     ignore:
       - dependency-name: "*"
         # patch and minor updates don't matter for libraries as consumers of this library build