chore: import upstream snapshot with attribution

.github/dependabot.yml

@@ -0,0 +1,48 @@
+version: 2
+updates:
+  # Automatically check for updates in framework CLIs for C3
+  - package-ecosystem: "npm"
+    open-pull-requests-limit: 10
+    directory: "/packages/create-cloudflare/src/frameworks"
+    schedule:
+      interval: "weekly"
+      # Don't run these at midday on Mondays, when we are busy trying to land PRs
+      day: "sunday"
+      time: "06:00"
+    versioning-strategy: increase
+    # Match the 24h minimumReleaseAge enforced by pnpm in pnpm-workspace.yaml
+    # so Dependabot doesn't open PRs that CI will then reject.
+    cooldown:
+      default-days: 1
+    # the following is used to add the [C3] prefix to the PR title,
+    # we override the commit message but setting a prefix like this
+    # makes it so that also the PR title gets such prefix
+    commit-message:
+      prefix: "[C3] "
+    labels:
+      - "package:c3"
+      - "dependencies"
+      - "ci:skip-pr-description-validation"
+
+  # Check for workerd & workers-types updates for Miniflare
+  - package-ecosystem: "npm"
+    # If you restrict the update to a directory that is not the root
+    # then it will not update the pnpm-lock.yaml.
+    directory: "/"
+    groups:
+      # We want to keep workerd and workers-types updates in lock-step
+      workerd-and-workers-types:
+        patterns:
+          - "workerd"
+          - "@cloudflare/workers-types"
+    schedule:
+      interval: "daily"
+      time: "06:00"
+    versioning-strategy: increase
+    labels:
+      - "miniflare"
+      - "dependencies"
+      - "ci:skip-pr-description-validation"
+    allow:
+      - dependency-name: "workerd"
+      - dependency-name: "@cloudflare/workers-types"