move to dependabot

[priv-kweihmann]

To have a more reliable setup

• pin versions of the dependencies of this repo to feature releases (~=)
• add dependabot config and let it run at least weekly