[v3-3-test] Group Dependabot security updates and keep v3-3-test covered (#70556)

[github-actions]

• Group Dependabot security updates

Dependabot groups only apply to security updates when they declare
applies-to: security-updates; without it a group covers version updates
only. Every group in our config relied on that default, so alert-driven
bumps bypassed grouping entirely and opened one PR each - axios in edge3
(#70145), mermaid (#69132, #69137), gitpython (#70428), zeep (#68780),
@hey-api/openapi-ts (#69265) and the two /go-sdk Go bumps (#70226, #69214).

Add a security-updates group to every entry that targets the default
branch. Entries carrying target-branch: v3-3-test are deliberately left
alone: Dependabot raises security updates against the default branch only,
so a security group there would never match. Comments note this so it does
not look like an oversight.

The three existing *-major-version-updates groups were already
applies-to: security-updates but restricted to update-types: [major],
so minor and patch security fixes fell through ungrouped. They are widened
to cover all security updates and renamed to *-security-updates to match
what they actually do.

Also adds a gomod entry for /go-sdk, which had no configuration at all -
its Go security bumps were arriving individually because Dependabot raises
security updates for ecosystems with no entry, but can only group them when
one exists.

Generated-by: Claude Opus 5 (1M context)

• Mirror remaining dependency directories onto v3-3-test

Dependabot raises security updates against the default branch only, so a fix
that lands on main does not reach a maintenance branch by itself. Cherry-picking
one over is unreliable: these commits carry lock file diffs, and main's lock
files have long diverged from v3-3-test's, so the pick conflicts more often than
not.

Letting Dependabot maintain the branch directly avoids that entirely - it
resolves the dependency and regenerates the lock file on v3-3-test itself. Six
directories were tracked on main but not on the maintenance branch, so a fixed
version had no way of reaching it:

• npm: edge3 www, fab www, /registry, react plugin template
• uv: /dev/breeze
• gomod: /go-sdk

They now have target-branch: v3-3-test entries following the policy the branch
already uses for core-ui and auth-ui: minor and patch only, majors ignored. A
fix that needs a major bump still has to be backported by hand.

dev/update_github_branch_config.py generates the same six entries, so cutting
the next release branch does not silently reintroduce the gap.
(cherry picked from commit 00679b8)

Co-authored-by: Jarek Potiuk jarek@potiuk.com
Generated-by: Claude Opus 5 (1M context)