ci: suppress dependabot updates for test fixture manifests

[ruromero]

Summary

• Problem: exclude-paths in dependabot.yml only applies to version updates, not security updates. This caused 26+ noisy PRs from dependabot trying to bump intentionally-pinned vulnerable deps in test fixture manifests under test/providers/tst_manifests/ and test/providers/provider_manifests/.

• Solution: Add dedicated dependabot entries per ecosystem that target the test fixture directories with ignore: [{dependency-name: "*"}] to suppress both version and security update PRs (ref). The ignore option supports security updates unlike exclude-paths.

Changes

Ecosystem	Change
npm (production)	Added provider_manifests/** to exclude-paths
npm (test fixtures)	New entry with directories targeting all JS test fixture dirs + ignore: *
pip, uv, maven, gradle, cargo, gomod	Replaced broad directory: "/" entries with targeted directories pointing to test fixture paths + ignore: *
uv, gradle, cargo	New ecosystem entries (previously missing — uv alone caused 4 security PRs)

What this does NOT suppress

npm deps like picomatch and brace-expansion that exist in both test fixtures AND the production transitive dependency tree. Ignoring those would also suppress legitimate production security updates.

Test plan

• Verify dependabot stops creating PRs for test fixture manifests (check after next scan cycle)
• Verify production npm security/version updates still work
• Close existing 26 test fixture dependabot PRs after confirming

🤖 Generated with Claude Code