Add Dependabot for NuGet packages and GitHub Actions

[JacobPoteet]

Nothing in the repo watches the dependencies we pull from outside. The three NuGet packages in src/ExplorerHelper and the five actions the workflows pin drift silently until something breaks or a security advisory lands. This adds .github/dependabot.yml covering both.

What changed

A single new file, .github/dependabot.yml, with two ecosystems:

• nuget, rooted at /. Dependabot scans down from there, so it picks up src/ExplorerHelper (CommunityToolkit.Mvvm, Microsoft.Web.WebView2, WPF-UI) and any project added later without needing a second entry. Minor and patch bumps are grouped into one PR; majors stay ungrouped so a breaking WPF-UI or WebView2 change gets reviewed on its own.
• github-actions, all five actions across ci.yml, pages.yml, and release.yml, grouped into a single PR.

Both check weekly, Monday 06:00 America/Chicago. NuGet is capped at 5 open PRs.

Notes for review

• ci.yml triggers on pull_request, so every bump Dependabot opens is smoke-tested through build.ps1 — the publish path, not just a compile. No workflow changes were needed to get that.
• src/ExplorerHelper.ShellExtension has no PackageReferences, so there is nothing for the NuGet updater to track there. CI's second step still builds it explicitly (issue [BUG] CI never compiles ExplorerHelper.ShellExtension; it can break on main undetected #37), which is what catches an action bump that breaks the extension build.
• I created the dependencies and ci labels on the repo out-of-band, since neither existed and Dependabot silently drops labels it cannot find.
• Not covered: release.yml builds the Inno Setup installer, and Inno isn't a dependency in any ecosystem Dependabot understands. That stays a manual bump.
• Dependabot ignores this file until it is on the default branch, so nothing happens until this merges.

🤖 Generated with Claude Code