Fix scorecard alerts in dart-lang / test about .github

[devoncarew]

cc @natebosch (the detailed issues can be seen here: https://github.com/dart-lang/test/security/code-scanning).

[natebosch]

@kevmoo - what is our current best practice for dependabot and mono_repo?

[kevmoo]

I try to roll mono_repo ~monthly. In did it a bit earlier because of a node deprecation.

What more do we think we need?

[natebosch]

@devoncarew @godofredoc - should we stop flagging a missing dependabot config in repos that are using mono_repo?

[godofredoc]

@natebosch can you please provide more context about the question?

[natebosch]

This alert indicates that we should be adding dependabot config to the test repo - however adding it would conflict with the updates done by mono_repo. So I think it's better to not raise this repo as an issue.

[godofredoc]

I see, in that case I'd recommend to ignore the alert. Let me send a PR to add the scorecards badge.

[godofredoc]

dart-lang/test#1774 is ready unfortunately I have no write access to assign reviewers.