Add dependabot configuration

[matthiasbeyer]

This should not be merged before the CI PR (#50) is decided on.

Because if this is merged, it might open up a lot of PRs quickly, and they are much easier to handle if (for example) bors is set up (see #50).