Enable Dependabot for GitHub Actions

[kou]

Our workflows use old GitHub Actions. For example, we use actions/checkout@v3 but actions/checkout@v5 is the latest version:

https://github.com/google/flatbuffers/blob/599847236c35fa3802ea4e46e20e93a55d3a4a94/.github/workflows/build.yml#L33

https://github.com/actions/checkout/releases

How about enabling Dependabot? If we enable Dependabot, Dependabot opens PRs that update old GitHub Actions.

Dependabot document: https://docs.github.com/en/code-security/dependabot

Dependabot configuration document: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference

[jtdavis777]

@bjornharrtell I noticed you were interacting with dependabot recently, is this something you could comment on?

[bjornharrtell]

@jtdavis777 not sure what you mean with interacting, it wasn't concious. :) That said, I don't see why not... except that flatbuffers as a project seem to lack maintainers/time, so it might increase burden.

[jtdavis777]

ah I had just seen that you had approved #8779 and I think merged a different PR into that branch. I'm unsure who (of the active participants :D ) has experience and authority with the CI

[fliiiix]

Yeah the biggest downside i see is that i creates usually a lot of MR, i am personally not the biggest fan but i agree with @kou we should take a look at the CI and modernize it a bit - i have that on my todo but didn't get to it yet :see_no_evil:

Update i took some time to update it a bit: https://github.com/google/flatbuffers/pull/8812