Automated dependency alerts and updates with Dependabot

[rliberoff]

It can be overwhelming to stay on top of the latest security considerations for every dependency ENMARCHA has.

To reduce this overhead, GitHub provides Dependabot alerts that watch dependecy grpahs for us. It then cross-references target versions with versions on known vulnerability lists. When a risk is discovered, the project is alerted. Input for the analysis comes from GitHub Security Advisories.

A dependency alert can lead to a project contributor bumping the offending package reference to the recommended version and creating a pull request for validation. However this could be automates with Dependabot, which scans for dependency alerts and creates pull requests so that a contributor can validate the update and merge the request.

More information here: https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates