ci: ignore Dependabot bumps of packages pinned by semgrep (#6062)

semgrep requires exact or compatible-release versions of mcp, boltons and
the opentelemetry packages. Bumping them alone makes the Semgrep job fail
at pip install (see #6054, #6055, #6057, #6058, #6060, #6061), so leave
them to move with the semgrep bump.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/dependabot.yml

@@ -60,3 +60,10 @@ updates:
       interval: daily
     cooldown:
       default-days: 7
+    ignore:
+      # semgrep pins these packages to exact or compatible-release versions (see its METADATA);
+      # bumping them on their own makes the Semgrep job fail with ResolutionImpossible, so
+      # they only move together with a semgrep release
+      - dependency-name: mcp
+      - dependency-name: boltons
+      - dependency-name: "opentelemetry-*"