ci: group dependabot updates for multi-subpath actions

[jamescrosswell]

#skip-changelog

Summary

Fixes #5466.

Dependabot treats each subpath of an action repository as a separate dependency. That's why #5461 bumped github/codeql-action/init to 4.37.3 and left analyze on 4.37.1 — CodeQL then failed with:

Loaded a configuration file for version '4.37.3', but running version '4.37.1'

This adds a single wildcard groups entry to the github-actions ecosystem, so every action is bumped together in one PR:

groups:
  github-actions:
    patterns:
      - "*"

This is the same approach getsentry/sentry-java already uses. Besides fixing the mismatch, it collapses the weekly stream of one-PR-per-action version bumps into a single PR, which is a good deal less noisy. It also covers any action repo added later without needing further config.

Repos in this repository that are consumed via more than one subpath, and so depend on this lockstep:

• github/codeql-action — init, analyze
• getsentry/github-workflows — danger, validate-pr, updater, sentry-cli/integration-test
• getsentry/craft — root action + the changelog-preview.yml reusable workflow
• actions/cache — root + restore

References

• Dependabot options reference → groups — syntax; applies-to defaults to version updates
• Optimizing PR creation for version updates — patterns match dependency names, * wildcard supported

One behaviour this relies on is not covered by those docs: grouping for the github-actions ecosystem is never explicitly documented as supported. It's in active production use in getsentry/sentry-java and GitHub's own actions/checkout, which is the basis for relying on it here.

Notes for review

• getsentry/craft is already drifted on main and this PR does not correct it: release.yml:38 pins 2.26.14 while changelog-preview.yml:19 pins 2.26.12. Nothing is broken today because the two are used independently, and the new group should pull them back into lockstep on Dependabot's next run. Flagging it in case you'd rather see it corrected explicitly here.
• .github/dependabot.yml changes only take effect once merged to the default branch, so CI on this PR can't demonstrate the fix. The init/analyze mismatch that prompted it was fixed directly on build(deps): bump github/codeql-action/init from 4.37.1 to 4.37.3 #5461, where Analyze is now green.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.69%. Comparing base (2fd8ff7) to head (68a6399).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5467   +/-   ##
=======================================
  Coverage   74.69%   74.69%           
=======================================
  Files         512      512           
  Lines       18722    18722           
  Branches     3660     3660           
=======================================
  Hits        13985    13985           
  Misses       3865     3865           
  Partials      872      872           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.