enable dependabot for GitHub actions

[ranocha]

This allows to get updates for GitHub actions automatically. I have used this for my own packages, the Trixi.jl framework, and the SciML organization. After merging this, you could also enable other Dependabot actions in 'Settings -> Code security and analysis -> Dependabot alerts' and '... -> Dependabot security updates'.

See https://github.com/SciML/MuladdMacro.jl/pull/37

[codecov-commenter]

Codecov Report

Merging #481 (eabbbc3) into master (ddd937c) will not change coverage. Report is 5 commits behind head on master. The diff coverage is n/a.

@@          Coverage Diff           @@
##           master    #481   +/-   ##
======================================
  Coverage    0.00%   0.00%           
======================================
  Files           9       9           
  Lines        1435    1435           
======================================
  Misses       1435    1435