Create dependabot.yml

[koddsson]

I'm hoping this will allow us to stay on top of security updates for both Chai 4 and Chai 5.

cc/ #1684

[Copilot]

Pull Request Overview

This PR creates a Dependabot configuration file to help us stay on top of security updates for both Chai 4 and Chai 5.

• Adds a new dependabot.yml file under the .github directory.
• Configures two update entries for the npm package ecosystem: one for the default branch and one for branch "4.x.x".

[keithamus]

We probably shouldn't use both Renovate & Dependabot; other repos in the chai org use renovate. Perhaps worth looking into that?

The config for loupe was added in chaijs/loupe@c457f7a.

Looks like baseBranches can be used to select multiple branches to ensure stuff is up-to-date in 4.x, so maybe we want something like:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended"
  ],
  "baseBranches": ["main", "4.x.x"],
  "packageRules": [
    {
      "groupName": "dependencies",
      "matchUpdateTypes": [
        "minor",
        "patch"
      ],
      "schedule": [
        "before 9am on monday"
      ]
    }
  ]
}

[koddsson]

Ah I keep forgetting we're using Renovate. I'll look into that and then open up a new PR.