dependabot: pip floor-only bumps on the generated requirements.txt are noise; pick a versioning strategy

[gonzalesedwin1123]

Follow-up from the dependabot PR wave of 2026-09-07 (#502–#506), all closed without merging. Filed so the policy decision is on record rather than repeated PR-by-PR.

What happened

Five dependabot pip PRs landed the same morning. Four (#502, #504, #505, #506) only raised a >= floor on a dependency we already resolve above the floor in the image, so they changed nothing installed and just cost CI + review time. One (#503, jwcrypto) rewrote a line in the root requirements.txt into jwcrypto>=1.6.0>=1.5.6, which does not parse and broke the Docker build; the upgrade was unmergeable anyway because Odoo 19 pins cryptography==42.0.8 and jwcrypto ≥ 1.5.9 needs cryptography ≥ 49.

Two root causes:

1. Root requirements.txt is generated ("# generated from manifests external_dependencies", first line of the file). The source of truth is each module's __manifest__.py external_dependencies. Dependabot editing the generated file fights the generator and, as deps(python): update jwcrypto requirement from >=1.5.6 to >=1.6.0 #503 showed, can corrupt it. Dependabot cannot update manifest dicts.
2. Floor bumps are noise for us. Our installed versions come from the Docker build resolving against Odoo's own requirements.txt pins, not from these floors. A >= bump that stays below what we already install is a no-op.

Options

• A. versioning-strategy: increase-if-necessary on the pip ecosystem. Dependabot then only edits a requirement when the current spec excludes the new version. Cheapest change; keeps security-advisory PRs (the ones we actually want) and drops most floor-only bumps. Does not fix root cause 1.
• B. Point the pip ecosystem at docker/requirements.txt only (directory: "/docker") and stop dependabot from touching the generated root file. Fixes root cause 1. Combine with A.
• C. Disable pip version updates and rely on dependabot security updates + pip-audit in security.yml (already runs over the merged requirement set). Least noise; loses proactive non-security bumps, which we were closing anyway.

Suggested: A + B. Also worth adding an ignore for jwcrypto minor/patch until Odoo's cryptography pin moves, with a comment pointing at #503 so the next person does not re-litigate it.

Scope

.github/dependabot.yml only. No module changes. One-line-ish PR once the option is chosen.