Changes:

• Adds support for the cooldown feature for the github-actions, go and npm ecosystems in .github/dependabot.yml. https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown-
• Uses the existing workflow to automerge dependabot updates https://github.com/grafana/security-github-actions/blob/main/.github/workflows/dependabot-automerge.yaml
• Downgraded the version of react-router-dom to v6 since we don't actually support v7 yet. We aren't actually using anything specific in react-router-dom so this should be fine since Grafana is actually still on v5.
• I removed the resolutions for dependencies that were added for CVEs or for fixing tests. Running yarn why on each of the dependencies listed in the resolutions list showed that it's either no longer used, or that no vulnerable versions were resolved:
  • wrap-ansi: found versions 7.0.0 and 8.1.0 however, there were no listed vulns here https://security.snyk.io/package/npm/wrap-ansi I think this was added to fix issues with the build, but running test:ci, typecheck, lint, and build don't have any errors so it might not be needed anymore.
  • string-width: found versions 4.2.3 and 5.1.2 however, there were no listed vulns here https://security.snyk.io/package/npm/string-width so i suspect this may have been added for some compatibility reasons, but running test:ci, typecheck, lint, and build don't have any errors so it might not be needed anymore