chore: disable Dependabot version updates (#14)

Removes .github/dependabot.yml, which was the only source of the
automated npm and github-actions bump pull requests. The six open
Dependabot PRs (#1, #2, #3, #6, #7, #13) were closed alongside this.

Nothing else in the repository referenced the config. Production
dependencies remain gated by `npm run audit:prod` in the CI
release-artifacts job. Dependabot security alerts are a repository
setting and are unaffected.

Note: every action in ci.yml and security.yml is pinned by commit SHA
and will now only move when bumped manually.

Author: sorrycc