[Eduardo Villalpando Mello (edvilme)]

Fixes #26258

Summary

• Combine npm, pip, and GitHub Actions version updates into one daily multi-ecosystem Dependabot PR, capped at one open version-update PR.
• Enable npm updates for the root and Python extension API manifests, include Python build and Jedi requirements, and preserve existing Python exclusions and the GitHub Actions cooldown.
• Preserve the no-changelog label and apply skip package*.json for npm updates so existing PR checks remain compatible.
• Automatically approve non-draft Dependabot-authored PRs with a minimal-permission GitHub Actions workflow that never checks out PR code.

Inspired by microsoft/vscode-python-environments#1959.

Validation

• Daily schedule assertions and targeted Prettier checks passed; all other configuration is unchanged.
• Dependabot JSON schema validation passed.
• Focused assertions passed for the shared daily group, PR limit, manifest directories, labels, preserved exclusions, bot/draft approval gating, permissions, and checkout-free workflow.
• Repository-wide Prettier checks passed using Windows-compatible quoting; npm run format-check itself failed because its single-quoted globs are not handled correctly by the Windows shell.
• git diff --check passed.

Operational notes

• Security updates remain separate from daily multi-ecosystem version updates.
• Auto-approval requires the repository setting Allow GitHub Actions to create and approve pull requests. Reading that setting returned HTTP 403, so it could not be verified.
• The local branch is dependabot; the remote branch is dependabot-config because existing dependabot/* refs prevent publishing dependabot.