Adds a workflow that hopefully

• runs any time a dependabot-created PR is opened, reopened, or synchronized (more commits are added)
• runs npm run boot which runs lerna bootstrap in both plugins and examples
• commits any resulting changes to the same dependabot-created PR
• doesn't block dependabot from making further commits to the PR e.g. in response to a command to rebase

The reason this is needed is because when dependabot makes a PR it updates the package-lock for a plugin but doesn't run lerna bootstrap. The result is that plugins keep having local dependencies added to their package-locks by dependabot, and then later they might be removed when a human runs lerna bootstrap, cluttering up other PRs. These local dependencies should not be part of the package-lock files -- that's just how lerna works :/

No idea if it works as intended until we submit it and try to run it on a dependabot PR, but at the very least I'm pretty confident it shouldn't ruin anyone else's non-dependabot PRs.