ci: harden dependabot review workflow

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

Author: lelia

.github/dependabot.yml

@@ -9,6 +9,12 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 5
+    allow:
+      - dependency-name: "python"
+      - dependency-name: "ghcr.io/astral-sh/uv"
+      - dependency-name: "trufflesecurity/trufflehog"
+      - dependency-name: "aquasec/trivy"
     labels:
       - "dependencies"
       - "docker"
@@ -23,6 +29,13 @@ updates:
     directory: "/app_tests"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 2
+    allow:
+      - dependency-name: "python"
+      - dependency-name: "golang"
+      - dependency-name: "securego/gosec"
+      - dependency-name: "trufflesecurity/trufflehog"
+      - dependency-name: "aquasec/trivy"
     labels:
       - "dependencies"
       - "docker"
@@ -37,6 +50,14 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 4
+    groups:
+      github-actions-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
     labels:
       - "dependencies"
       - "github-actions"