chore: give the 4.2 maintenance branch Dependabot coverage (#626)

Nothing has ever watched the oc10 branch, which is why it drifted to 84
advisories against master's 39. Dependabot reads .github/dependabot.yml only
from the default branch, so 4.2 cannot carry its own copy -- the coverage has to
live here, as a second set of entries with target-branch: "4.2".

Be clear on what this does and does not buy. target-branch produces weekly
*version update* PRs against 4.2, which is the mechanism that keeps the branch
from going stale. Dependabot security *alerts* stay default-branch-only, and
GitHub does not create security updates for a target-branch at all. So 4.2 gets
routine bumps but never an alert; its scanning coverage is the Trivy job added
on that branch instead.

Schedule, PR limit and the minor-and-patch grouping mirror the existing entries
exactly, so the two branches behave the same way.

Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
Co-authored-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: oc-tmueller

.github/dependabot.yml

@@ -1,7 +1,63 @@
 version: 2
+
+# The entries below are duplicated per branch on purpose. Dependabot reads this
+# file only from the default branch, so the oc10 maintenance branch cannot carry
+# its own copy - it is covered by the "target-branch: 4.2" entries here.
+#
+# Note what that does and does not buy: target-branch produces weekly *version
+# update* PRs against 4.2, which is what keeps the branch from going stale.
+# Dependabot security *alerts* remain default-branch-only, and GitHub does not
+# create security updates for a target-branch at all. So 4.2 gets routine bumps
+# but never an alert; its scanning coverage is the Trivy job on that branch.
+
 updates:
+  # ---------------------------------------------------------------- master (oc11)
+  - package-ecosystem: composer
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: sunday
+      time: '22:00'
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    groups:
+      minor-and-patch:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: sunday
+      time: '22:00'
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    groups:
+      minor-and-patch:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: sunday
+      time: '22:00'
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    groups:
+      minor-and-patch:
+        update-types:
+          - minor
+          - patch
+
+  # ------------------------------------------------------------------- 4.2 (oc10)
   - package-ecosystem: composer
     directory: "/"
+    target-branch: "4.2"
     schedule:
       interval: weekly
       day: sunday
@@ -16,6 +72,7 @@ updates:
 
   - package-ecosystem: npm
     directory: "/"
+    target-branch: "4.2"
     schedule:
       interval: weekly
       day: sunday
@@ -30,6 +87,7 @@ updates:
 
   - package-ecosystem: github-actions
     directory: "/"
+    target-branch: "4.2"
     schedule:
       interval: weekly
       day: sunday