Group the routine dependency bumps into one review (#22)

Ungrouped, a week of updates fans out into one pull request per package.
That would be tolerable if each were a merge, but every one of them needs a
generated artifact regenerated by hand before it can go green, so the queue
costs a manual step per package rather than per week.

One are open here right now; grouped, the same set would have arrived as
one, with the major left individual so a breaking change is still reviewed
on its own.

The shape is the one flyto-console already uses and flyto-landing-page proved:
across this workspace the three repositories with grouping sit at zero or one
open pull request, and the ones without sit at their limit.

Author: ChesterHsu

.github/dependabot.yml

@@ -1,13 +1,23 @@
+# Routine bumps arrive as one pull request per ecosystem; majors stay
+# individual so a breaking change is reviewed on its own. Ungrouped, a week of
+# updates fans out into one pull request per package, and each one needs a
+# generated artifact regenerated by hand before it can go green.
 version: 2
 updates:
   - package-ecosystem: npm
     directory: /
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
+    groups:
+      minor-and-patch:
+        update-types: ["minor", "patch"]
 
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
+    groups:
+      minor-and-patch:
+        update-types: ["minor", "patch"]