Group Dependabot updates monthly, one PR per ecosystem

[dduugg]

Summary

• Dependabot now checks monthly instead of weekly, and puts each ecosystem's updates in one PR: one for gems, one for GitHub Actions. This matches packs-specification and the other rubyatscale repos.
• The labels, open-pull-requests-limit and cooldown are unchanged.

Why

• With weekly, ungrouped updates, Dependabot opens a PR for every gem with a new release. Within minutes of Have Dependabot update gems #47 adding bundler, it opened ten (Bump packwerk from 3.2.2 to 3.3.1 #48–Bump rspec from 3.13.0 to 3.13.2 #57), reaching open-pull-requests-limit, with more updates waiting behind them.

After merging

• Dependabot's next run should open a single grouped bundler PR covering those gems. If any of Bump packwerk from 3.2.2 to 3.3.1 #48–Bump rspec from 3.13.0 to 3.13.2 #57 are still open after that, close them.
• Groups apply to version updates only. Security updates still arrive one at a time, as soon as an alert opens.

Not changed

• The github-actions entry labels PRs github_actions, but that label doesn't exist in this repo, and Dependabot won't create it.