Add dependabot and pin node dependencies

[palemieux]

Closes #263

[nigelmegitt]

This means it will check weekly, but during that check, it might update a dependency to a release made only hours ago. If you want to avoid supply chain attacks, setting a longer cooldown period would mean that, during the check, it will only apply updates that are at least as old as that cooldown period. By setting the cooldown period to e.g. 7 days (which is what we use in BBC) that gives the rest of the ecosystem that long to identify and address any "bad" releases. I'd recommend doing that.