Add Dependabot for GitHub Actions and Swift packages

[hisaac]

Add .github/dependabot.yml covering GitHub Actions and Swift package updates, so dependencies stop
drifting silently between manual passes.

Watch out for

• Confirm Dependabot can actually see the Swift packages. Its Swift support is oriented around a
  Package.swift manifest. This project has no manifest — package references live inside
  project.pbxproj, and the resolved file is at
  CenterMouse.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved. Verify it picks
  these up rather than assuming, otherwise the config will look configured while doing nothing.
• The packages are pinned to exactVersion. Dependabot may not be able to propose anything until
  those become ranges, which is a deliberate decision rather than an oversight to correct in passing.
• The github-actions ecosystem is straightforward and worth doing regardless — the workflow already
  pins actions/checkout@v6 and jdx/mise-action@v3.

Notes

Set a sensible schedule and open-PR limit; this is a small project and weekly is plenty. Grouping
updates into a single PR is usually nicer than three separate ones here.