Group dependabot updates to reduce PR noise

[Sekator778]

Following up on #71. Groups minor and patch maven bumps into one PR and all github-actions bumps into another; major maven updates stay individual so each still gets looked at on its own. The three existing ignore entries are untouched.

Against the three dependabot PRs open right now this gives 2 instead of 3 — #180 and #181 collapse into one, #179 is a different ecosystem and groups don't span ecosystems.

One thing I'd rather you decide than assume: dependabot only groups what it finds in a single run, so on daily most bumps still arrive alone and grouping only helps when several land the same day. weekly would bundle considerably more. I left the interval at daily — say the word and I'll change it in this PR. Security updates run on their own schedule either way.

---

Summary by cubic

Groups Dependabot updates so minor and patch Maven bumps arrive in one PR and all GitHub Actions bumps in another, reducing PR noise. Major Maven updates stay individual, and the three existing ignore entries are untouched.

• With the current daily interval, grouping only helps when multiple bumps land the same day; switching to weekly would bundle considerably more.

^{Written for commit 4a2f3b7. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[Sekator778]

CI is green here now on JDK 17, 21 and 25. The run had been parked at action_required since 9 September because fork PRs need workflow approval, so this was never a failure.

Could one of you take a look: @davidpavlovschi @joshuabrandes @KushalLukhi @nrayburn-tech? This PR is mine, and the convention I proposed in #71 is that nothing merges on its author's approval alone, so I would rather not merge it myself.

What it does: Maven and Actions updates each land as one grouped PR per ecosystem, on the daily schedule that was already configured. Maven majors stay separate. Actions majors do not, which was an oversight.

Edited after this merged. The paragraph above originally said both ecosystems kept majors separate, and called the schedule weekly. Neither was right: the interval is daily and this PR never touched it, and only the Maven group carries update-types. actions/setup-java 5.7 to 6.0.1 closed #179 and came back inside the group as #184 the same day. #185 adds the missing restriction.