Try configuring Dependabot for security updates

[aduth]

🛠 Summary of changes

Revises the Dependabot configuration to restore the behavior of automatic update pull requests for security advisories.

Based on Dependabot logs bailing with "all versions were ignored" messaging, it's suspected that customizations to Dependabot implemented in #9055 and #5462 are taking precedence over the default Dependabot configuration for security advisories, which was not the intent. Our bundler-audit and yarn audit-based dependency auditing has worked as a fallback option, but it would be nice to configure Dependabot to automatically update dependencies on our behalf when a new version is available.

While GitHub does not provide specific example configurations for our setup, this is based partly on documentation that "If you only require security updates and want to exclude version updates, you can set open-pull-requests-limit to 0 in order to prevent version updates for a given package-ecosystem"

📜 Testing Plan

This may not be possible to test until merged. After merged, it's expected that we'd receive Dependabot pull requests for both security advisories, as well as the package-specific version updates currently configured.

[aduth]

We should know shortly after this is merged if it's successful, I'll try to trigger a manual run to see if we can catch the outstanding Puma upgrade.