MAINT add dependabot for gh actions

[jolars]

Add dependabot to keep gh actions up to date.

[jolars]

I am seeing:

+ res='{"message":"Token required - not valid tokenless upload"}

400'
++ echo '{"message":"Token required - not valid tokenless upload"}

in the codecov step.