chore(security): add Dependabot config for php-sdk

Review PR #1 and the proposed .github/dependabot.yml configuration first. Validate the repository CI and the stated Dependabot checks, including security-only alerts, no routine version-bump PRs, and targeting main; the work is done when those checks pass.

Change type

Standard — low-risk, pre-approved

Risk / impact

Low

Security impact

No — no security impact to application code. This change enables security tooling (Dependabot security-only alerts/PRs) but does not touch any runtime code, dependencies, or behavior.

Details — description & full context

Adds a security-only .github/dependabot.yml for this repo's Composer dependencies, modeled on the working TurboDocx/html-to-docx Dependabot config.

• open-pull-requests-limit: 0 means Dependabot only surfaces real CVE/security-fix alerts and PRs — no routine version-bump noise.
• No code changes, no runtime impact.
• Part of a broader patch-duty tooling audit that found this repo had no automated security-patch coverage.

See PR #1 for the implementation.

Testing & validation

• CI passes on the PR
• Confirm Dependabot picks up the config on main (Insights > Dependency graph > Dependabot)
• Confirm no non-security PRs get opened (limit is 0)
• Confirm a security advisory affecting a Composer dependency produces a PR targeting main

Rollback plan

Revert the merge commit that adds .github/dependabot.yml.

Breaking change?

No