config scorecard and dependabot for security

[carpenter79]

scorecard Potential Security Improvements #1599

dependabot Dependabot creates pull requests to keep your dependencies secure and up-to-date. You can opt out at any time by removing the .github/dependabot.yml config file.