chore: disable Dependabot automatic security update PRs (#436)

Set github.dependabot_updates to false in .asf.yaml so Dependabot no
longer opens automatic security update pull requests. Security alerts
are fixed through regular dependency-bump PRs instead.

Dependabot alerts are not changed and stay enabled.

Generated-by: Kiro Crew (claude-opus-5.5)