Add allow list to git dependabot config

[ann0see]

We might want to add "allow" to the git dependabot configuration.

I'd leave it open for a few hours (or days) and then merge even if @mcfnord doesn't add it. Otherwise, we should open an issue.

Ursprünglich gepostet von @ann0see in #3848 (comment)

[mcfnord]

🤖 AI: With one submodule in the tree, an allow list is a no-op today and narrows coverage later.

Dependabot's own gitsubmodule updater image (digest sha256:654790f61d7d9016aec48174d27cc1815248b7cf711d39495808bddcb757dc93) was given this repo's .gitmodules plus a second submodule of the kind that could be added later. Job#allowed_update? returns:

allow:	libs/oboe	a submodule added later
omitted	true	true
- dependency-name: "libs/oboe"	true	false
- dependency-name: "libs/*"	true	true
- dependency-name: "*"	true	true

libs/oboe is the name to use — it is the string Dependabot emits in the #3905 commit trailer.

The linked recipe answers "update only one of many submodules". Here it would instead pin coverage to today's tree, reintroducing for the next submodule the state #3848 ended: this one sat on oboe 1.7.0 (2022-12-15) through five later releases. - dependency-name: "*" makes the covered set explicit and measures identical to omitting the key.