dependabot: group minor and patch updates

[timonegk]

This change should let dependabot create a single pull request for all minor and patch releases, reducing the workload for maintainers. If you want, I can also look into the automerge behavior for minor and patch releases.