Enable dependabot.

These require the minisign binary to be installed.

This allows us to skip sticking it onto each request context and retrieving it.

Signed-off-by: Dan Lorenc <dlorenc@google.com>

also make GOVERSION an environment variable

This runs against a running setup, and does a single upload of some node
data.

Also add the "openapi" branch to CI.

* turn on gosec and resolve blocking issues