Replace Renovate with Dependabot

[chemicL]

This PR is a continuation of #3232 and supersedes that one.

Soon, hopefully, Dependabot will be able to support version catalogs: dependabot/dependabot-core#6249

That's why the libs.versions.toml file is still kept, despite introducing a bit of duality in the build setup.

---

Below is @simonbasle's original description:

This PR replaces Renovate with Dependabot.

Despite being less configurable, Dependabot can target a non-default branch.

One limitation is that Dependabot currently doesn't process version catalogs, even in the standard format of gradle/libs.versions.toml.
It should however be able to process version strings imported from a .gradle file as long as the filename contains dependencies` (see source).
So unfortunately this means rolling back version catalogs, at lest partially.

The version declarations broadly go into 4 categories:

1. Reactor versions that we always edit during the release
2. Versions that we want to more closely monitor, or freeze
3. Plugins
4. Other libraries

While (4) can and should be managed by Dependabot, the first three categories cannot or shouldn't.
In this PR I chose to keep (1/2/3) in the libs.versions.toml version catalog and split out versions from (4) into a new gradle/dependencies.gradle file to be imported.

That file would thus be understood, monitored and updated by Dependabot only, while we continue to make manual edits to gradle/libs.versions.toml (and root gradle.properties).

Drawbacks

The plugins won't be auto-updated anymore and will need manual monitoring and updates.

Alternatives

This is more a question of style but in the current state, we reintroduce the artifact coordinates in each build.gradle (eg. implementation "group:my-artifact:$myArtifactVersion").
I've found one blog post that uses a different style where the whole coordinates are defined inside the dependencies.gradle file in a dictionnary:

// in gradle/dependecies.gradle:
libs = {
myArtifact : "group:my-artifact:$myArtifactVersion"
}

// in individual build.gradle files
dependencies {
implementation libs.myArtifact
}
See blog post.
This could be considered as a further improvement.

[chemicL]

It's also worth noting that plugin updates might also be supported soon, as per the recent update here: dependabot/dependabot-core#1164 (comment)

[reactorbot]

@chemicL this PR seems to have been merged on a maintenance branch, please ensure the change is merge-forwarded to intermediate maintenance branches and up to main 🙇