disable non-security dependabot PRs

[matt-codecov]

EDIT: also moved to weekly

8 open dependabot PRs felt like a bit of a nuisance. i'd like to do one of three things to rein it in, each having pros and cons:

• disable dependabot PRs for non-security updates (this PR)
  • pro: minimal overhead, minimal noise, minimal chance of regressions from dependency updates
  • con: misses improvements from minor version updates, and makes updating in the future a bigger chore
• run weekly instead so we can get into a routine of dealing with them all on monday
  • pro: less noisy
  • con: security updates happen less immediately
• telling dependabot to group all updates into a single PR
  • pro: less noisy
  • con: if a single update requires a code change (like winnow right now) you can't merge the rest of them

input welcome

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 98.53%. Comparing base (94b6424) to head (ac63222).
Report is 11 commits behind head on main.

✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #49   +/-   ##
=======================================
  Coverage   98.53%   98.53%           
=======================================
  Files          22       22           
  Lines        6776     6776           
=======================================
  Hits         6677     6677           
  Misses         99       99           

Components	Coverage Δ
core	98.61% <ø> (ø)
bindings	79.31% <ø> (ø)
python	100.00% <ø> (ø)

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[jeff-a-holland-codecov]

LGTM

[jeff-a-holland-codecov]

LGTM

[Swatinem]

I would recommend all three approaches together.