chore: configure dependabot not to update to spring 6

[raboof]

To replace #555 et al

Thanks for your contribution to Apache Commons! Your help is appreciated!

Before you push a pull request, review this list:

• [x] Read the contribution guidelines for this project.
• [ ] Run a successful build using the default Maven goal with mvn; that's mvn on the command line by itself.
• [ ] Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. This may not always be possible but is a best-practice.
• [ ] Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
• [x] Each commit in the pull request should have a meaningful subject line and body. Note that commits might be squashed by a maintainer on merge.

[ppkarwasz]

Spotbugs has no support for Java 25, why do we even run tests on it?

[garydgregory]

That's why it's marked an experimental build, so we can find out what works and what doesn't.