ci: group security updates the way version updates are grouped

[AndresSaa]

The problem

.github/dependabot.yml already declares a catch-all group, so weekly dev-dependency bumps arrive as one pull request. Security advisories did not — #43 and #44 are two separate pull requests, three lockfile lines each, from a single @mermaid-js/mermaid-cli upgrade.

That is not a Dependabot quirk. applies-to defaults to version-updates, and grouping applies only to what a group is declared to apply to:

applies-to — Use to specify whether the rules in the group apply to version updates or security updates. When undefined, defaults to version updates.
— Dependabot options reference

So the group was silently doing half its job.

The change

A second group with identical membership and the other value:

groups:
  dev-dependencies:
    applies-to: version-updates
    patterns: ["*"]
  security-advisories:
    applies-to: security-updates
    patterns: ["*"]

Both take everything, which is not laziness: a package that ships zero runtime dependencies has nothing in this manifest that is not dev tooling. The existing ignore entries for typescript and @types/node are untouched and still apply.

Group names have to be unique, hence two names rather than one entry with two values.

How it was tested

npm run lint                → clean (prettier parses the YAML)
ajv vs. SchemaStore dependabot-2.0.json → VALID: true

The schema check is worth stating precisely, because applies-to is the kind of key that is easy to put at the wrong nesting level. It resolves to /definitions/update/properties/groups/additionalProperties, i.e. a property of an individual group — which is where this puts it:

enum: ["version-updates", "security-updates"]

One caveat, stated rather than glossed over: GitHub only parses dependabot.yml from the default branch, so no CI check on this pull request validates it. Schema validation is the strongest proof available pre-merge. After merge, the Dependabot tab under Insights → Dependency graph reports a config error if one exists — worth a glance.

Contract impact

None. Repository automation only; nothing in src/, no effect on the published package.