Add Dependabot config for Bundler and GitHub Actions

[jramos]

Summary

• Adds .github/dependabot.yml tracking Bundler and GitHub Actions weekly.
• open-pull-requests-limit: 3 per ecosystem; PRs target develop.
• versioning-strategy: lockfile-only on bundler — lockfile moves automatically, gemspec/Gemfile constraints only change on human intent.
• CHANGELOG entry under [Unreleased].
• docs/dependencies.md "Dependency update strategy" section updated — no longer claims the repo has no Dependabot.

Test plan

• CI green on the feature branch (unchanged Ruby code, spec suite should be unaffected).
• After merge: Insights → Dependency graph → Dependabot lists bundler and github-actions as tracked ecosystems with no red parse error.
• Next weekly run opens bump PRs (if any updates are available) against develop, labeled dependencies.