add .github/dependabot.yml (#1060)

* add .github/dependabot.yml

This attempts to group all security related fixes for docs/ gems
into one PR on a monthly basis.

* clear yamllint warnings

ignoring 'document-start'

.github/dependabot.yml

@@ -0,0 +1,13 @@
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "bundler"
+    directory: "/doc"
+    schedule:
+      interval: "monthly"
+    groups:
+      doc-gems-security:
+        applies-to: "security-updates"
+        patterns:
+          - "*"