Enhancement: Use dependabot

[localheinz]

This PR

• adds a Dependabot - and removes the Violinist - configuration

💁‍♂ This probably requires to set up Dependabot and disable Violinist - is this something you would be up for, @Jan0707?

[Jan0707]

What's the benefit that we see here ?

[localheinz]

@Jan0707

Dependabot can be configured to

• update composer.json as well
• automatically merge pull requests when the build passes

For reference, see https://dependabot.com/docs/config-file/.

I believe the most compelling argument is that pull requests can be automatically merged.

Apart from that, Dependabot has been acquired by GitHub and is the de-facto standard solution for updating dependencies for a wide range of package managers.

[localheinz]

@Jan0707

Violinist currently updates composer.lock only, which is pretty much useless, as we run builds against lowest, locked, and highest versions.

[Jan0707]

I feel this would bind us even more to Github and its eco system. Is that a shared concern? If not then we could go ahead.

[Jan0707]

ping @localheinz
I assume you think this is a worthwhile trade-off ?

[localheinz]

@Jan0707

With Dependabot moving natively into GitHub, I think that the switch makes a lot of sense.

In addition, the latest version of Dependabot allows updating GitHub Actions as well.