Automate DependaBot merges and patch releases

[rwillians]

Sometime ago I set up DependaBot and it's creating security-update PRs, but I personally don't have the time to review, merge and release. I think it would be great if we could automate this.

I imagine something like:

• DepeendaBot create PR;
• if it fails passing the CI, nothing happens (someone has to review, should prob create an issue);
• it merges the PR;
• it publishes a release;
• new releases (tags) are automatically published to npm

I'm also open to suggestion :)