fix: group dependabot updates

[SgtPooki]

See some examples that resulted from this config:

• deps: bump the helia-deps group across 3 directories with 7 updates helia-verified-fetch#141
• deps: bump the store-deps group across 1 directory with 2 updates helia-verified-fetch#142
• deps: bump the kubo-deps group across 3 directories with 2 updates helia-verified-fetch#143

[github-actions]

🎉 This PR is included in version 45.0.5 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[achingbrain]

This may not be behaving in the desired fashion. See these two dependabot PRs for the same dep in the same file opened at the same time with different titles:

• deps: bump undici from 6.21.0 to 7.0.0 helia-verified-fetch#154
• deps: bump undici from 6.21.0 to 7.0.0 in /packages/gateway-conformance helia-verified-fetch#155

[SgtPooki]

@achingbrain interesting.. I think thats due to the "/" being included along with directories of actual packages in a monorepo...

Looking back at the documentation it seems like this is a bug with github's grouping and that it should be only opening a single, ungrouped, PR

If a dependency doesn't belong to any group, Dependabot will continue to raise single pull requests to update the dependency to its latest version as normal. GitHub reports in the logs if a group is empty. For more information, see "Dependabot fails to group a set of dependencies into a single pull request."

- https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#groups