Add workflow to sync configurations across repositories

[jaimergp]

The sync workflow will help us keep several pieces of repo configuration up-to-date instead of having to submit PRs manually to all of them (and maybe missing some in the process). As a byproduct, we will have a list of repositories with workflows that depend on external actions.

So far we are adding config for:

• Dependabot rules
• Keep alive workflows

The repos are in place, but I suggest we first test against cf-autotick-bot-test-package-feedstock.

A token will be added to this repo with the necessary permissions.

[jaimergp]

Well, I learnt in conda/menuinst#197 that Dependabot won't turn the @vX.Y tags into hashes automatically, so I'll need to do that by hand anyway (but using https://github.com/mheap/pin-github-action). I guess that in that case we won't need automation to set this up so I'll omit this approach for now. The dependabot config won't change that much anyway.

[wolfv]

nice, thanks!

[jaimergp]

The action I wanted to use for this only supports opening PRs from a branch in the target repo, which means adding special write permissions on that repo. Either through manually generated tokens stored as secrets (not ideal), or a through an app installed for that purpose (a bit better, but still requires manual approval on each repo). The alternative is to submit PRs from a (bot) account because that's all we need. However such automation is not available on any action, afaik. We would have to write something, but this kind of thing is easier these days via gh. For now, I'm pausing further work here as the "bleeding" was stopped via manually submitted PRs.

[beckermr]

I'd love to sync pre-commit configs across various code bases as well. That is more controversial maybe, but we can opt out certain repos like conda-smithy.