fix(deps): group Dependabot security updates per directory

[omarshahine]

Security updates are not grouped by default, so a repo with several advisories in one lockfile gets several PRs that all edit that lockfile. Merging any one invalidates the rest, @dependabot recreate rebuilds them, and the next merge breaks them again.

Lobster, findmy-cli and openclaw-parcel were stuck in exactly that loop tonight — recreated, went green, conflicted again on the next merge. Twice.

applies-to: security-updates collapses them into one PR per directory, which ends the thrash.

Lobster had no npm entry at all (its npm PRs were pure security updates), so it gains entries for its three manifest directories. travel-hub keeps its @omarshahine/* allow-list and daily interval — the group is additive.

[greptile-apps]

Greptile Summary

Adds a Dependabot security-update group for the /openclaw npm directory so advisories sharing its lockfile are handled in one pull request.

• Matches all security updates in the directory.
• Preserves the existing production and development grouping for version updates.

Confidence Score: 5/5

The PR appears safe to merge with no actionable issues identified.

The new group uses supported Dependabot security-update syntax, and the existing production and development groups remain scoped to version updates.

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds a valid wildcard security-update group without changing the existing version-update groups.

_{Reviews (1): Last reviewed commit: "fix(deps): group Dependabot security upd..." | Re-trigger Greptile}