Enable Dependabot and update CI to add missing permissions

[gwynne]

Title pretty much says it all.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.53%. Comparing base (b7854a8) to head (5b19390).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #219      +/-   ##
==========================================
+ Coverage   45.75%   46.53%   +0.78%     
==========================================
  Files          46       46              
  Lines        1906     1863      -43     
==========================================
- Hits          872      867       -5     
+ Misses       1034      996      -38     

see 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.