ci: add Dependabot config for uv and Docker dependencies

[tabedzki]

🤖 Human guided, AI assisted PR (using this skill). AI text below. 🤖

What changed

Adds .github/dependabot.yml (the repo had Dependabot alerts and automated security fixes enabled, but no config file), modeled on the sibling configs in BrainCOGS/tech_calendar_streamlit#111, BrainCOGS/WaterPubsGUI#4 and BrainCOGS/U19-Data-Viewer#15.

ecosystem	directory	schedule	notes
uv	/	monthly, Wed 06:00 UTC, 7-day cooldown	grouped (python), deps: prefix, limit 5
docker	/	monthly, Tue 06:00 UTC	grouped (docker), docker: prefix, limit 5

Ignore rules on uv (each commented inline with when to remove it):

• datajoint >=2.0 — 2.x renamed its config file to datajoint.json and ignores the dj_local_conf.json the BrainCOGS repos ship. pyproject.toml already pins datajoint<2.0.0.
• setuptools >=82 — datajoint <2.0 does import pkg_resources in plugin.py, which connection.py imports on every import datajoint. setuptools 83.0.0 removed pkg_resources entirely and there is no installable replacement (pkg_resources was never published separately; importlib.metadata has no equivalent for the egg_info path datajoint uses). In a clean venv the import fails with ModuleNotFoundError: No module named 'pkg_resources' — verified in BrainCOGS/tech_calendar_streamlit#110. Consequently the setuptools alert (GHSA-h35f-9h28-mq5c) is being dismissed as tolerable risk rather than fixed; low exposure (ReDoS over trusted package metadata).

Deliberately omitted:

• github-actions — .github/workflows/ does not exist in this repo. Add a Monday-slot entry if workflows are introduced.
• pip for requirements.txt — nothing in the repo consumes it (README instructs uv sync; Dockerfile does pip install -e; no script references it). It's legacy, and a pip entry alongside uv would just produce duplicate PRs. Deleting the file is a separate decision.

Why this PR first

Automated security fixes are already on. The ignore rules need to reach master before the lock-upgrade PR lands, otherwise Dependabot will keep regenerating an unmergeable setuptools 81→83 bump.

Verification

• uv run --isolated --no-project --with pyyaml python -c "import yaml; ..." — parses; prints docker / 5 [] and uv / 5 ['datajoint', 'setuptools'].
• No pre-commit config in this repo; no tags created.
• gh pr list --author app/dependabot --state open: Bump anyio from 4.13.0 to 4.14.2 #119 anyio, Bump soupsieve from 2.8.4 to 2.9 #118 soupsieve, Bump gitpython from 3.1.50 to 3.1.59 #116 gitpython, Bump cryptography from 48.0.0 to 50.0.0 #115 cryptography, Bump tornado from 6.5.6 to 6.5.8 #113 tornado, Bump icalendar from 7.1.2 to 7.1.3 #110 icalendar, Bump pydantic-settings from 2.14.1 to 2.14.2 #93 pydantic-settings — no setuptools PR to close. The others will be superseded by the follow-up fix(deps) lock-upgrade PR.

Assisted-by: ClaudeCode:claude-opus-5