Dependabot: grouped updates

[github-product-roadmap]

Summary

Today, Dependabot generally sends one PR per package updated. Unfortunately, sometimes there are dependencies that ought to be updated together, and there's no way for developers to specify which ones.

Intended Outcome

To make Dependabot work better for developers and dependencies that need to be updated together.

How will it work?

We will allow developers to add configuration into their Dependabot.yml which lets them specify the set of dependencies that should be updated together.