chore: group Dependabot updates by type and isolate majors

[mcgroarty]

Summary

Reduces PR noise from Dependabot by grouping minor/patch updates into a small number of grouped PRs, while letting major bumps arrive as individual PRs for isolated review.

Groups

• astro — astro core + @astrojs/* packages (kept first so these land here instead of in production-dependencies)
• production-dependencies — other runtime dependencies
• dev-dependencies — devDependencies (tooling, types)
• security-updates — all advisories bundled into one PR (applies-to: security-updates is required because security PRs are individual by default, even when they match a version-update group)
• actions — GitHub Actions workflow updates

Major version bumps fall outside all groups and arrive as individual PRs so breaking changes can be reviewed in isolation, matching theMajor version bumps fall outside all groups and arrive as individual PRs so breaking changes can be reviewed in isolation, matching theMajor version bumps fall outside all groups and arrive as leaMajor version bumps fall outside all groups and arrive as individual PRs so breaking changes can be reviewed in isolation, matching theMajor version bumps fall outside alle file is now self-documenting with inline comments explaining each group.

• No changes to update cadence (still weekly).
• open-pull-requests-limit: 10 is preserved; grouped PRs don't count against the cap, so the cap only restrains standalone major bumps.