Support multiple directories to bump the same package across dependency files

[foolip]

In https://github.com/web-platform-tests/wpt we track Python dependencies with a number of files named requirements_*.txt across directories, since the project is used in a number of different contexts (mostly browser engines like Chromium, Gecko and WebKit) where only a subset of the dependencies are needed.

We switched from pyup to Dependabot in web-platform-tests/wpt#29161, and quickly found that Dependabot is creating separate pull requests for the same dependency across files, for example web-platform-tests/wpt#29223 + web-platform-tests/wpt#29227 or web-platform-tests/wpt#29219 + web-platform-tests/wpt#29224 + web-platform-tests/wpt#29225.

We want those dependencies to stay in sync, so it would be much better if they were updated together. Unfortunately, there doesn't seem to be a way to specify multiple directories. This was the state of our config when the PRs were created:
https://github.com/web-platform-tests/wpt/blob/f44fd9953ebdbe8ef90ddf3bae8daaaa0173a92c/.github/dependabot.yml

Note that this is not the same request as #2178, wildcards would not help us since there's no pattern that would match everything we want to update and still exclude all the things we don't want to touch (third party code).

[mwaddell]

Solving this is a more general way is a bit beyond dependabot's scope. However, you should be able to solve this with a custom github workflow. You would create an action that runs whenever a new PR is created by dependabot and it uses github-script to locate instances of the same dependency in other locations across your repo and then merges the changes from the new PR into the existing one and closes this new PR with a comment referring to the other PR.

[jeffwidman]

This is a monorepo specific problem, so is tricky because some users want us to bump a dep across all apps/libraries in the monorepo, and others want us to only bump in one specific place at a time.

So if we added support for this, we'd need to ensure it was configurable. For now, I created the F: monorepo label so we can track the monorepo-related feedback together and added this to it.

[jeffwidman]

Actually, this is a duplicate of:

• Create 1 PR for the same update across update configs #1595

So follow/upvote that for updates.