Setup dependabot for key dependencies

[BigLep]

Done Criteria

Lotus has dependabot configured for critical dependencies so we proactively stay updated where it matters most.

Critical dependencies to proactively update with dependabot

@rvagg (and others) will fill this in:

• ipfs/boxo
• libp2p/go-libp2p
• filecoin-project/go-state-types

Why Important

We have a lot of technical debt regarding dependencies and adhoc best efforts when we feel like it haven't been effective enough. We get into positions where we need to update a dependency but then suffer the pain of having grown too far out date. The most recent example as of 2025-07-24 is #13197.
Not updating proactively has the impact of:

1. Tasks requiring a dependency update can mushroom with unexpected work.
2. We miss out on the security and performance improvements that have been shipped.

User/Customer

Maintainers

Notes

1. This is taking a pragmatic approach. We're not going to blanket update all our dependencies. This will create too much noise. Instead, we'll focus on the most beneficial items (e.g., items that when released almost always involve bubbling up to Lotus anyways, items that are painful to get too far behind on).
2. It's intended to scope / define this issue well so @copilot can take this on.
3. Having a robust mechanism for all our dependencies is covered in Lotus has a mechanism to update dependencies #12227.

[rvagg]

Similar to my comment in filecoin-project/ref-fvm#2188 (comment), this should be a signal to maintainers to investigate and test and consider whether these dependencies should be upgraded. Dependabot doesn't get to demand, just inform us.

Other dependencies I think it would be worth getting notifications about:

• All direct dependencies starting with github.com/filecoin-project (except specs-actors)
• All direct dependencies starting with github.com/ipfs
• All direct dependencies starting with github.com/libp2p
• All direct dependencies starting with github.com/multiformats
• github.com/gorilla/mux
• github.com/gorilla/websocket
• github.com/mattn/go-sqlite3
• github.com/whyrusleeping/cbor-gen
• github.com/zondax/ledger-filecoin-go
• golang.org/x/crypto

[rvagg]

Doing this check monthly with dependabot will keep us sane I think. We'll get the security ones more rapidly anyway.