dependabot PRs not updating pnpm-lock.yaml

[thehenrytsai]

dependabot PRs currently do not include pnpm-lock.yaml, upon the PR merged, the release workflow runs pnpm install --frozen-lockfile which expects the pnpm-lock.yaml to be up-to-date (not allowed to change), but since it is not, the workflow fails.

Some possible solutions:

1. Update dependabot to include pnpm-lock.yaml
2. Update release workflow to allow pnpm-lock.yaml to be modified.
3. Remove dependabot (not ideal because we introduced it for another reason: we depended on obsolete dependencies and were pinged by tbdex team)

[shamilovtim]

I vote to turn off Dependabot. It has been a burden, caused version discrepancies between dwn-sdk-js and web5-js, wasted CI cycles, and is generally annoying. I'm happy to handle dependency upgrades manually. I wasn't aware we had a mandate for doing so and it's not difficult to handle manually.