Switching over to dependabot and specific versions

[waja]

This solution has the limitation that it can't handle the alpine version of the php image. But the alpine version in the php image tag has no patch version number. So this might not very relevant.