Turn on Dependabot for NuGet, Docker and GitHub Actions #616

Part of #607.

Why

Snyk runs when an image is built. Nothing tells the team about a new advisory between builds, and
nothing proposes updates.

Scope

• Add .github/dependabot.yml for nuget (/src), docker (the Dockerfiles) and
  github-actions.
• Group minor and patch updates to keep the number of pull requests low.
• Turn on Dependabot security alerts for the repository.

Done when

• Dependabot opens update pull requests for each ecosystem.
• Security alerts are on.