ci: add security-aware Dependabot updates for Python and GitHub Actions (#3641)

- [x] I understand that this repository is auto-generated and my pull
request may not be merged

## Changes being requested

- Add the missing repository-level Dependabot v2 configuration for the
root PEP 621 Python project and GitHub Actions workflows.
- Schedule low-noise Monday UTC updates with separate Python/Actions
windows, an eight-day cooldown for routine version updates, and
three/five open-PR limits; security updates remain independently
eligible without that cooldown.
- Group Python minor/patch maintenance separately from security
remediations, and update coupled CodeQL init/analyze actions together
while leaving unrelated SHA-pinned actions independently reviewable.
- Avoid a duplicate `uv` updater: the repository installs Rye-generated
`requirements.lock` and `requirements-dev.lock`, and Dependabot cannot
regenerate those files. The config explicitly instructs maintainers to
run `rye lock --all-features` and `uv lock` before merging any Python
dependency update.

## Verification

- Parsed the YAML and validated it against the current Dependabot v2
JSON Schema.
- Validated exact supported ecosystems, root manifest discovery,
staggered weekly schedules, cooldowns, PR limits, maintenance/security
group semantics, CodeQL grouping, and absence of
reviewers/assignees/target-branch overrides.
- Confirmed all eight runtime dependencies satisfy `pyproject.toml`
across `uv.lock`, `requirements.lock`, and `requirements-dev.lock`;
verified the existing uv lockfile is structurally valid offline.
- Verified all 46 GitHub Actions references remain pinned to full commit
SHAs and both PyPI release workflows retain isolated build/upload jobs
and publishing-only OIDC.
- `python scripts/check-python-version-policy.py`
- `git diff origin/main...HEAD --check`

## Additional context & links

Only `.github/dependabot.yml` is added. Rye-only development
dependencies and Rye lock regeneration remain manual because Dependabot
has no supported Rye ecosystem.