chore(security): add Dependabot security-update config

[nicolasiscoding]

Closes #2

Summary

• Adds a security-only Dependabot config for this repo's Composer dependencies, modeled on the working TurboDocx/html-to-docx config.
• open-pull-requests-limit: 0 means this only surfaces security-fix alerts/PRs — no routine version-bump noise.
• No GitHub Actions workflows were found in this repo, so no github-actions ecosystem entry was added.

Part of the patch-duty tooling audit.

Test plan

• Confirm Dependabot picks up the config on main (Insights > Dependency graph > Dependabot)
• Confirm no non-security PRs get opened (limit is 0)
• Confirm a security advisory affecting a Composer dependency produces a PR targeting main

[nicolasiscoding]

🤖 Automated code review (Claude, light effort)

Reviewed this PR's .github/dependabot.yml diff. Checked: valid YAML, every package-ecosystem/directory pair maps to a real manifest in this repo, target-branch matches the repo's actual default branch, and open-pull-requests-limit: 0 is intact on every entry (so this stays security-fix-only — no routine version-bump PR noise was introduced).

Findings: none. No correctness issues found at light-review depth.

This comment and the underlying review were written by Claude (Anthropic), run by @nicolasiscoding as part of a patch-duty tooling rollout — not a human reviewer. Treat as an automated check, not a substitute for a real approval.