Cleanup/package json and dependabot

[MaddyMicrosoft]

Will fix #594

Changes

Remove the accidental package-lock dependency. package.json listed a package literally named package-lock (^1.0.3), which is unrelated to the real package-lock.json lockfile. It pulled lodash, commander, asyncc, and traverse into the dependency tree for no reason. Removing it drops all four transitive packages, shrinking the install and the supply-chain surface.

Remove the unused version field from package.json. The field was never kept in sync with the released version (releases are driven by git tags, not npm), so it was misleading. Dropping it removes a stale source of truth.

Add .github/dependabot.yml. Enables monthly Dependabot updates for two ecosystems:

• npm (dev-dependencies grouped into a single PR)
• github-actions (all action bumps grouped into a single PR)

Both capped at 5 open PRs. This keeps @actions/* packages and workflow action pins current without manual tracking, and surfaces security bumps automatically.

Notes

• No runtime behavior change: the removed package-lock package and its transitives were never imported by the action code.
• Grouping keeps Dependabot noise low (one PR per ecosystem per month rather than one per package).