ci: automate Dependabot updates and auto-merge

[okurz]

Motivation:
Automate GHA workflow updates via Dependabot and automatically squash-merge
them when CI passes to eliminate manual maintenance.

Design Choices:
Configured Dependabot for github-actions and added a squash auto-merge
Mergify rule for dependabot[bot]. Removed obsolete delayed-merge rules.

Benefits:
Saves maintainer time by fully automating dependency updates with high security
while preserving clean linear git history.

[AdamWill]

I don't particularly love this because I worry about the risk of evil updates. Can we add a cooldown to this?

[Martchus]

Good point. I have assumed this is just our default config where we specified a cooldown at some point. Now, looking at the change again, I can't find any cooldown. I found that os-autoinst/openQA@29862d9 claims there would be a default cooldown of 7 days. However, I haven't found any reference about that on https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown-. I hope the 7 day default cooldown isn't a hallucination of some AI model. Maybe we also shouldn't rely on a default for a security critical setting anyway.

We should probably clarify this before proceeding with these kinds of changes.

[okurz]

I haven't applied a cooldown for GitHub action definitions in general but we should. And the dependabot cooldown functionality is definitely not an AI hallucination.
@Martchus you were referencing a mergify change but link to a dependabot page. The cooldown is done by dependabot, see https://github.com/os-autoinst/openQA/blob/22de1d3e80e3c0fdde0ea5758c8f798aaf984df8/.github/dependabot.yml#L10

[Martchus]

@Martchus you were referencing a mergify change but link to a dependabot page.

Yes, but the message of the referenced commit states:

Remove the 4-day wait rule and use Dependabot's built-in 7-day cooldown

Hence I assumed it is a Dependabot default and checked their config. Especially the wording "built-in" makes it sound like that.

https://github.com/os-autoinst/openQA/blob/22de1d3e80e3c0fdde0ea5758c8f798aaf984df8/.github/dependabot.yml#L10

Ok, so this default is actually a default specified by us and not a general default of Dependabot. Then we probably need to add the cooldown in https://github.com/os-autoinst/openQA-python-client/blob/main/.github/dependabot.yml as well if we want to automate merging those PRs.

[okurz]

@Martchus you were referencing a mergify change but link to a dependabot page.

Yes, but the message of the referenced commit states:

Remove the 4-day wait rule and use Dependabot's built-in 7-day cooldown

Hence I assumed it is a Dependabot default and checked their config. Especially the wording "built-in" makes it sound like that.

https://github.com/os-autoinst/openQA/blob/22de1d3e80e3c0fdde0ea5758c8f798aaf984df8/.github/dependabot.yml#L10

Ok, so this default is actually a default specified by us and not a general default of Dependabot. Then we probably need to add the cooldown in https://github.com/os-autoinst/openQA-python-client/blob/main/.github/dependabot.yml as well if we want to automate merging those PRs.

done in #88

[AdamWill]

Then I guess this is fine. I don't love it, but eh, I'm outvoted.