add dependabot configuration, fixes #3242

Closes #3242

Merge request studip/studip!2201

.gitlab/dependabot.yml

+version: 2
+updates:
+  - package-ecosystem: composer
+    directory: /
+    schedule:
+      interval: weekly
+    labels: []
+    versioning-strategy: lockfile-only
+    open-pull-requests-limit: -1
+    open-security-pull-requests-limit: -1
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    labels: []
+    versioning-strategy: lockfile-only
+    open-pull-requests-limit: -1
+    open-security-pull-requests-limit: -1

composer.json

@@ -28,7 +28,7 @@
         "mishal/iless": "^2.2",
         "ezyang/htmlpurifier": "^4.13",
         "davefx/phplot": "^6.2",
-        "jasig/phpcas": "^1.3",
+        "jasig/phpcas": "1.5",
         "phpxmlrpc/phpxmlrpc": "^4.4",
         "phpxmlrpc/extras": "^0.6.2",
         "algo26-matthias/idna-convert": "^3.0",