Extend Dependabot to cover NuGet and workshop npm dependencies

[Copilot]

Dependabot only inspected GitHub Actions, leaving the .NET packages and the workshop site's npm packages unmonitored. This adds nuget and npm update entries that follow the existing weekly/grouped/7-day-cooldown pattern.

NuGet

• Directories are listed explicitly (/, /src/**, /tests/**) because Dependabot does not resolve projects through the .slnx solution file; / picks up Directory.Packages.props for central package management.
• Minor and patch updates are ignored — the floating ranges (13.*, 1.*-*) already resolve those at restore time, so only major bumps are surfaced, matching the repo's versioning policy.

ignore:
  - dependency-name: "*"
    update-types:
      - "version-update:semver-minor"
      - "version-update:semver-patch"

npm

• Single entry for /workshop; Dependabot covers dependencies and devDependencies and keeps package-lock.json in sync.

Documented limitation

• Dependabot rewrites a floating range to a resolved version when opening a PR, so those PRs need the floating notation restored (e.g. 14.*, 2.*-*). Noted in a comment above the NuGet entry rather than implied to be handled automatically.

The GitHub Actions entry is unchanged. Whether the new update jobs discover the intended manifests without resolution errors can only be confirmed from Dependabot job logs once this is on the default branch.

• Fixes Extend Dependabot to inspect NuGet and workshop npm dependencies #38