Adjust dependabot config to reduce dependabot issue frequency

[mhucka]

Description of the issue

It's good that Dependabot is running and keeping dependencies up to date, but bad because it's creating a lot of individual PRs every week that require developer time spent dealing with them:

Dependabot has some config knobs we can fiddle with. We could try to adjust the config to reduce the spam. We could also investigate the use of auto-merging actions (e.g., merge-me-action) to auto-merge some Dependabot updates that are a low-risk. (E.g., maybe cirq-web JS updates can be auto-merged if they only involve minor version changes.)