Dependabot cannot be automatically upgraded to GitHub-native security updates

[dependabot-preview]

Dependabot Preview will be shut down on August 3rd, 2021.

This repository has been configured to only receive security updates from Dependabot Preview; however, the GitHub-native version of Dependabot does not provide security updates through a configuration file. If you wish to keep receiving security updates, please enable them via your repository's settings.

Once you have enabled Dependabot security updates, you can remove Dependabot Preview from your organization or personal account and your migration is complete.

[bmquinn]

We need to set up Dependabot according to the setup docs in repodev_planning_and_docs