chore(ci): enable and group Dependabot version updates

[jplbrun]

Description

Enables Dependabot version updates for the pip ecosystem (previously security-updates only) and groups them by update level to keep PR volume low.

Previously the pip block ignored all regular version updates (version-update:semver-major/minor/patch), so only repo-level Dependabot Security Updates produced PRs. Dependencies could silently drift between security advisories.

This change:

• pip: batches all non-major (minor + patch) version updates into a single weekly grouped PR (version-minor-patch). Major updates are intentionally not grouped — with no ignore rule in place, they fall through to individual PRs so each breaking bump can be reviewed in isolation.
• pip: adds a security group (applies-to: security-updates) so security fixes arrive as one consolidated PR rather than one-per-dependency.
• GitHub Actions: batches all Action bumps — majors included — into one grouped PR. Actions only affect CI (never the published SDK), so a bad major fails the workflow loudly on the PR; isolating majors buys little.

Grouping is level-only (no prod/dev split): the prod/dev boundary in this repo is blurred because several packages (cryptography, httpx, starlette, the web-framework extras) are declared in both [project] and [dependency-groups] dev.

Related Issue

N/A

Type of Change

• Dependency update

How to Test

1. Merge and let the Monday schedule run, or manually trigger a Dependabot check from the Insights → Dependency graph → Dependabot tab ("Check for updates").
2. Confirm a single version-minor-patch PR is opened for batched minor/patch bumps, and that any available major bump appears as its own separate PR.
3. Confirm GitHub Actions bumps arrive as one grouped PR.

Checklist

• I have read the Contributing Guidelines
• I have verified that my changes solve the issue
• I have added/updated automated tests to cover my changes
• All tests pass locally
• I have verified that my code follows the Code Guidelines
• I have updated documentation (if applicable)
• I have added type hints for all public APIs
• My code does not contain sensitive information (credentials, tokens, etc.)
• I have followed Conventional Commits for commit messages

Breaking Changes

None

Additional Notes

None

[jeanscherf]

Great job!