* Add CodeQL analysis workflow configuration
* Add Dependabot configuration for package updates
Configure Dependabot to check for updates in various ecosystems weekly.
* Fix dependabot.yml: bun ecosystem, missing dir, grouping for PR #4479
1. studio/frontend uses bun.lock not package-lock.json, so change npm to bun
2. Add missing studio/backend/requirements/ pip entry (consumed by studio/setup.sh)
3. Add groups with patterns ["*"] to all pip/bun/npm entries to batch updates
and avoid 30+ individual Dependabot PRs on the first run
* Consolidate pip blocks to fix overlapping directory violation
GitHub Dependabot forbids multiple same-ecosystem entries with
overlapping directories on the same branch. The root "/" directory
overlapped the 3 nested pip dirs. Merge all 4 pip blocks into one
using the `directories:` (plural) key.
Also remove redundant open-pull-requests-limit from the bun block
since grouping with patterns: ["*"] already limits PR count.
---------
Co-authored-by: Daniel Han <danielhanchen@users.noreply.github.com>
