ci: add dependabot

[untereiner]

No description provided.

[cssherman]

Looks good to me - have you worked with dependabot before? Given the config, what do you expect the alerts look like?

[untereiner]

It should look like this one: GEOS-DEV/GEOS#3154
I think I can also assign the PR to someone to merge it.

[untereiner]

I added you to the reviewer list. Let's try it.

[cssherman]

@untereiner - looking at the failed test, it seems like the network may be causing some issues with pip install (see https://stackoverflow.com/questions/71435874/pip-these-packages-do-mot-match-the-hashes-from-the-requirements-file). Thoughts?

[untereiner]

It seems very arbitrary.
I know more poetry. I found a tuto to build and publish but didn’t find a good one for linting and testing. Do we agree that testing is the only reason to install locally in the ci the dependencies ?

[untereiner]

I would avoid the « requirements.txt not in the repo » thing by using tox for testing. Python guys are sometimes quite fool see pypa/pip#11440

[untereiner]

@cssherman I think the test workflow could be updated but it should be in another PR.
I propose to merge this one and I will open a new one for this subject.