Dependabot conclusion

[SRFU-NN]

We have now tried dependabot for a while, and it is time to decide if and how to use it in the future.

I really like it for Github actions, and suggest we keep it exactly as is.

I don't like it for python packages as we use it now. If we are to keep it here, I suggest we restrict it to major versions, e.g. 1.2.3 -> 2.0.0, not minor (1.2.3 -> 1.3.0) or patch (1.23 -> 1.2.4). It can be nice to know when something big happens.

Let me know what you think.