Declare dependencies differently, so that Dependabot "sees" them (and "group" dependencies which Dependabot already sees)

[vorburger]

The goal of this issue is to improve how this project declares its dependencies in Gradle.

The primary motivation for this issue is that the Dependabot which I activated in #2195 so far only raises a limited number of "version bump PRs", because as-is Dependabot only sees Gradle plugins, and the few Jackson dependencies declared in settings.gradle.kts and in common/build.gradle.kts and buildSrc/build.gradle.kts, as well as GitHub Actions - but it misses all the (more interesting) dependencies in buildSrc/src/main/kotlin/Dependencies.kt (understandably, because that's "non-standard / custom Kt Gradle code").

As a "side effect" of this work, I'm also hoping to be able to better declaratively define "groups" of dependencies which "belong together", so that Dependabot automatically (instead of me manually) raises #2301 instead of its individual (and incomplete) #2283 and #2285.

[vorburger]

I'll (propose to) introduce a gradle/libs.versions.toml

see https://docs.gradle.org/current/userguide/platforms.html

and https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates#gradle

[vorburger]

see also https://developer.android.com/build/migrate-to-catalogs

[vorburger]

With #2306 merged, the next step here (from my side) is to wait and see if Dependabot will automagically propose a bump for Glide...

[vorburger]

wait and see if Dependabot will automagically propose a bump for Glide...

Reminder to myself, I forgot about this: Because of how https://github.com/google/android-fhir/blob/master/.github/dependabot.yaml is currently configured, any #2306-like work will only lead to new dependency update PRs at interval: weekly on day: monday... should we make it more frequent?

[vorburger]

With #2306 merged, the next step here (from my side) is to wait and see if Dependabot will automagically propose a bump for Glide...

It see, see #2325.

Reminder to myself, I forgot about this: Because of how https://github.com/google/android-fhir/blob/master/.github/dependabot.yaml is currently configured, any #2306 work will only lead to new dependency update PRs at interval: weekly on day: monday... should we make it more frequent?

Let's keep it weekly.

#2591 will shortly move all remaining dependencies from Dependencies.kt into that libs.versions.toml.

Closing as Done!