MAINT: Group Dependabot security minor patch updates

[spencrr]

Description

Adds explicit Dependabot security-minor-and-patch groups for each configured ecosystem so minor and patch security updates are grouped separately from normal version updates.

This follows up on the recent separate Dependabot security PRs #2010, #2011, #2012, #2013, and #2015. The existing minor-and-patch groups only apply to version updates by default because Dependabot groups.applies-to defaults to version-updates when omitted. GitHub’s Dependabot options reference documents that applies-to supports both version-updates and security-updates.

Major security updates are intentionally left ungrouped. This keeps higher-risk updates, such as the major cryptography bump in #2015, isolated for review while reducing noise for lower-risk minor and patch security fixes.

References:

• Dependabot groups option: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#groups--
• Dependabot applies-to behavior: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#groups--
• Dependabot security updates: https://docs.github.com/en/code-security/dependabot/dependabot-security-updates

Tests and Documentation

Validated the Dependabot YAML edit with VS Code diagnostics and git diff --check.

No runtime tests or JupyText runs were needed because this change only updates Dependabot configuration.