ci(dependabot): group minor and patch updates into a single PR

[adrianbrad]

Summary

• Add groups config to both Dependabot ecosystems (gomod, github-actions) so all minor + patch bumps land in a single weekly PR per ecosystem instead of one PR per dep.
• Major versions remain outside the group and continue to open individual PRs for isolated review of breaking changes.
• Extend the auto-merge condition in dependabot-auto-merge.yaml to also fire when dependency-group is set, since grouped PRs leave update-type empty. Safe because grouping is restricted to minor/patch only.

Test plan

• After merge, manually trigger Dependabot via Insights -> Dependency graph -> Dependabot -> "Check for updates", or wait for the next Monday 06:00 schedule.
• Confirm a single PR titled build(deps): bump the github-actions group with N updates opens instead of N separate PRs.
• Confirm dependabot-auto-merge approves and squash-merges the grouped PR once required checks pass.
• When a major bump arrives next, confirm it opens its own PR outside the group.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (949dfd8) to head (770524d).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##              main       #74   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            6         6           
  Lines          639       639           
=========================================
  Hits           639       639           

Flag	Coverage Δ
unittests	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.