Add dependabot support w/ .dependabot/config.yml

 - Add [dependabot] support
 - Need to activate account for this project at
   https://app.dependabot.com/auth/sign-up
 - Keep dependencies up-to-date automatically
 - Not currently configured for auto-merging of PRs

Author: zbeekman

.dependabot/config.yml

@@ -0,0 +1,18 @@
+version: 1
+update_configs:
+  # Keep package.json (& lockfiles) up to date as soon as
+  # new versions are published to the npm registry
+  - package_manager: "javascript"
+    directory: "/"
+    update_schedule: "daily"
+    default_labels:
+      - "dependabot"
+      - "npm bump"
+  - allowed_updates:
+      - match:
+          update_type: "security"
+      - match:
+          dependency_type: "direct"
+  - commit_message:
+      prefix: "update"
+      include_scope: true