GH-500 decision sheets

• Automating security alerts: webhooks vs REST or GraphQL API
• CodeQL code scanning: default setup vs advanced setup
• Dependabot: security updates vs version updates, and auto-triage