Consider setting up Dependabot

[apasel422]

We might want to set this up in https://github.com/w3c/attribution/network/updates to avoid having to create PRs like #389 manually.

[martinthomson]

Unfortunately, I don't have the power to do this. @seanturner and @AramZS might have the keys, but I suspect that it's really @tjwhalen who is the only one in the position to do this.