Group dependabot updates into weekly PRs

[reinkrul]

Switch github-actions, gomod, and docker ecosystems from daily, ungrouped updates to weekly grouped PRs.

What changes

Ecosystem	Before	After
github-actions	daily, ungrouped	weekly, grouped (minor+patch)
gomod	daily, ungrouped	weekly, grouped (minor+patch)
docker	daily, ungrouped	weekly, grouped (minor+patch)
pip	weekly, disabled	unchanged

Why

• Cuts the daily flood of individual PRs down to ~one grouped PR per ecosystem per week.
• Each group is scoped to minor+patch. Major bumps stay outside the groups as individual PRs, so cross-breaking-change updates that need judgment remain individually reviewable.
• Preserves soak time and anti-drift currency on master.

Assisted by AI

[qltysh]

Coverage Impact

⬇️ Merging this pull request will decrease total coverage on master by 0.03%.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[stevenvegt]

Not sure if I understand. What do you mean by one grouped PR?
What if we have a high severity security fix, could these be go unnoticed by max 6 days?
How does this compare to just merge once a week instead of generating the PRs once a week?