Add Dependabot for GitHub Actions

[cgilet]

Summary

Adds Dependabot for the github-actions ecosystem so action versions stay current without
manual bumps, mirroring IAMR's configuration.

CI currently emits a deprecation warning on every run: actions/checkout@v4 and
actions/cache@v4 are being force-run on Node 24 because Node 20 is end-of-life. Rather than
hand-bump the refs, this lets Dependabot do it — the bump PRs it opens are both the fix and the
proof the config works.

Changes

• New .github/dependabot.yml — github-actions ecosystem, weekly, byte-identical to
  IAMR's. target-branch: development is required since that is incflo's default branch.

• branches-ignore: 'dependabot/**' on the push trigger of all 7 push-triggered workflows
  (gcc, sycl, cuda, hip, docs, style, codespell). Without this, every Dependabot branch runs CI
  twice — once for push, once for pull_request. Matches both AMReX and IAMR, which apply it
  to all push-triggered workflows rather than only the expensive ones. Existing schedule:
  crons are unchanged.

• codespell: ubuntu-22.04 → ubuntu-latest — both AMReX and IAMR already run this job on
  ubuntu-latest; incflo was the only one of the three still pinning it. With ubuntu-26.04
  now GA alongside 24.04, and GitHub keeping at most two GA images, 22.04 is on its way out.

• Fixes the concurrency group in docs.yml (pre-existing bug, noticed while testing this
  change). It was ${{ github.head_ref }}-docs, but github.head_ref is empty on push
  events, so every push in the repository shared one group, -docs, and with
  cancel-in-progress: true they cancelled each other's docs builds. Adding github.ref
  disambiguates per branch. This matches AMReX, and matches the six other workflows in this
  repository, which all already use the ${{ github.ref }}-${{ github.head_ref }}-* form —
  docs.yml was the lone holdout. (The same bug exists in IAMR, if you want it fixed there
  too.)

Action refs are deliberately left stale here. After merge, Dependabot will open the bumps itself
(actions/checkout 4→7, actions/cache 4→6), which is what clears the Node 20 warning.

Not covered by Dependabot (left for follow-up)

• docs.yml still runs on ubuntu-22.04 — matches IAMR today, but will need moving as 22.04 is
  retired. Deferred deliberately: the Sphinx/doxygen build is the most image-sensitive job here.
• Tool versions passed as script arguments (gcc 14, clang-tidy 21, CUDA 12.6).
• Unpinned pip3 install in docs.yml and codespell.yml. AMReX has since moved to
  hash-pinned .github/workflows/requirements/*.txt; IAMR has not, and this PR follows IAMR.

🤖 Generated with Claude Code