Enable Dependabot for GitHub Actions and npm dependencies #20

Description

There is no .github/dependabot.yml in the repo, so neither the GitHub Actions used in our workflows nor the npm dependencies get automated update PRs. This matters more once the repo is public: dependency freshness becomes visible, and supply-chain hygiene is part of what consumers of @kosli/mcp-server are trusting.

Proposed config

version: 2
updates:
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
      day: monday

  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
      day: monday

Notes

• All three workflows (ci.yml, release.yml, update-catalog.yml) pin actions to full commit SHAs with a version comment. Dependabot understands this pattern and updates both the SHA and the trailing comment, so pinning is preserved.
• Current npm surface is small: one runtime dependency (@modelcontextprotocol/sdk) and four dev dependencies (@types/node, tsx, typescript, vitest).
• The main ruleset requires signed commits. Dependabot's commits are signed by GitHub, so its PRs should not hit the problem that blocked chore: regenerate catalog from OpenAPI spec #18.
• Enabling Dependabot alerts and security updates is a repository settings toggle, separate from this config file. Worth turning both on at the same time.

Tasks

• Add .github/dependabot.yml with the github-actions and npm ecosystems
• Enable Dependabot alerts and security updates in repository settings