configure dependabot to keep Pipfile.lock and github actions up-to-date

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+
+updates:
+- package-ecosystem: pip
+  directory: /
+  versioning-strategy: lockfile-only
+  schedule:
+    interval: weekly
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: weekly