chore: Dependabot for security updates only, grouped

[xylo04]

Standardizes this repo on the same two-lane split we're rolling out across k0swe.

Renovate owns routine version updates. Its presets (group:monorepos, group:recommended) already group version-locked families — the Angular monorepo, Expo SDK, React Native — with no per-repo patterns to hand-maintain. The Mend-hosted app is free for public and private repositories.

Dependabot owns security updates. That is already all it does here: a repo with no dependabot.yml files security updates only, raised from Dependabot alerts.

This config makes that explicit and fixes a real failure mode:

• open-pull-requests-limit: 0 disables version updates. Per GitHub's docs this has no effect on security updates, so nothing is lost — and it prevents Dependabot racing Renovate with duplicate PRs.
• Groups carry applies-to: security-updates. That key is required: groups defaults to version-updates, so without it the grouping silently does nothing for security PRs.

Why grouping matters

A security wave touching co-dependent packages is unmergeable when split across PRs. Bumping @angular/common alone fails npm ci with ERESOLVE, because @angular/core stays pinned through the CDK/Material peer chain — no amount of rebasing fixes it, since the PR is incompatible by construction. One group means one PR and one coherent lockfile.

Directories were derived from the actual manifests in the tree, so every package.json / go.mod / requirements.txt in the repo is covered.