Define grouping for dependabot updates

There are should be at max 2 PRs per week:
one for patch updates and one for major updates.

Security fixes will still create separate PRs.

.github/dependabot.yml

@@ -12,3 +12,11 @@ updates:
     directory: /
     schedule:
       interval: weekly
+
+    groups:
+      minor:
+        update-types:
+          - minor
+      patch:
+        update-types:
+          - patch