Add dependabot for managing dependencies

[kannon92]

What would you like to be added:
We should add a bot to automatically upgrade our dependencies in go.mod.
Why is this needed:

Managing dependencies is tedious and can become a security problem if left alone for too long.
Completion requirements:

To do this, one just needs to add a dependabot.yml file to the .github

See below for an example:
https://github.com/kubernetes-sigs/controller-runtime/blob/master/.github/dependabot.yml

[alculquicondor]

let's take kubernetes libraries as an example:

Would the bot update to 1.26 when it's released? Or would it update to 1.25 when 1.24 is out of support?

[kannon92]

To be clear, it looks at what you have in your go.mod so it would upgrade k8s.io/client-go v0.24.3 to the latest when there is a release.

We can tell the bot to ignore dependencies if you want to control kubernetes apis closer

[alculquicondor]

if there is support for semantic versioning, it would be nice to upgrade to the latest patch version, but not minor.

[kannon92]

You can see an example of a PR it creates here armadaproject/armada#1670 and it has a decent amount of options.

[alculquicondor]

Ah, it's possible: https://github.blog/changelog/2021-05-21-dependabot-version-updates-can-now-ignore-major-minor-patch-releases/

[kannon92]

/assign @kannon92

I'll go ahead and add the yml. If we don't like it, we can just remove it from repo very easily.