Dependabot Grouping and Ignore Rules

Write a Dependabot config that updates us without a pull request for every patch of every package. ECOSYSTEMS [NPM, GITHUB ACTIONS, DOCKER — LIST] Update day: [WEEKLY ON A DAY] Groups I want: [TYPES, DEV TOOLS, PRODUCTION MINOR/PATCH] Major versions: [SEPARATE PRS | IGNORED UNTIL WE OPT IN] Security updates: [ALWAYS, UNGROUPED] DELIVER 1) dependabot.yml with a weekly schedule, a limit on open PRs, and groups that match what I asked. Production dependencies are not mixed with eslint if that hides a runtime change. 2) Ignore rules only for packages I named, each with a comment that says why and when to remove it: [PACKAGES OR NONE]. 3) Commit message prefix so the changelog can find them. 4) The branch protection note: grouped PRs still need CI, and an auto-merge rule only if CI is trustworthy. Say what I would turn on. 5) A note on lockfile-only changes and why we still review a "minor" of a framework. Do not disable security updates to reduce noise. Do not ignore a package because it was annoying once, unless I named it.