fix: resolve red dependency audit (fast-uri, js-yaml, qs) + add grouped Dependabot updates (#9)

Scheduled Dependency audit failed 3x (runs 34123426028, 34846427672,
35602599991) on 2 high advisories: fast-uri 3.1.5 (GHSA-5jgf-p345-68v8,
GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp) via ajv,
and js-yaml 4.3.1 (GHSA-2883-xcg3-v3hh) via textlint/rc-config-loader.
Bump lockfile to patched in-range versions: fast-uri 3.1.8, js-yaml
4.3.2, qs 6.16.0 (moderate GHSA-x5fp-wj9c-mxmx / GHSA-4mjr-xmp4-gh2g).
No manifest range changes; npm audit --audit-level=high now reports
0 vulnerabilities.

Add .github/dependabot.yml (weekly grouped npm + Actions, minor/patch
only) so future advisories arrive as PRs for the existing
dependabot-auto-merge workflow; majors stay manual.

Author: TheStreamCode

.github/dependabot.yml

@@ -0,0 +1,47 @@
+# Dependabot: weekly grouped npm + Actions updates.
+#
+# Pairs with `dependabot-auto-merge.yml`: patch/minor bumps merge
+# automatically once protection checks pass; majors stay open for
+# human review. Grouping keeps the PR noise to (at most) one npm
+# PR and one Actions PR per week.
+
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Europe/Rome
+    groups:
+      npm-minor-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
+        patterns:
+          - "*"
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Europe/Rome
+    groups:
+      actions-minor-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
+        patterns:
+          - "*"
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies