internal: Allow only security updates for Dependabot

[ChayimFriedman2]

No description provided.

[joshka]

I'm assuming this is to reduce noise - have you considered tuning this to be less frequent instead?
(i.e. weekly / monthly with a cooldown setting).

For rust updates it can be useful to use the new increase-if-necessary versioning-strategy, which allows you to set a proper minimal manifest version and only update it when there's an actual requirement that gets updated.

[ChayimFriedman2]

My main reason is that I don't think it's a good idea to bump minor versions unless you have a specific reason.

[lnicola]

I quite like the dependabot PRs because they have a handy link to the diff view, especially with increase-if-necessary. Unfortunately, what's on GitHub doesn't have to match what we pull from crates.io.

[lnicola]

I mean, it's fine if y'all feel like it's not worth upgrading all the time, I'm not completely against merging this.

[Veykril]

Actually, will this prevent security updates from happening? The docs don't really talk about this I think.

View changes since the review

[ChayimFriedman2]

It will not. GitHub explicitly says that in the example.

[Veykril]

Imo I'd be fine with just setting the general cadence up to 2 weeks or something like that