Change Dependabot step

[hectorsector]

The current issue about Dependabot currently asks the learner to close the issue. Considering there's a pull request from Dependabot open, could we instead have the learner merge that PR? I think it'd be a more realistic workflow.

[hectorsector]

I think this might replace the manual update of the package.json file, but I prefer it. Folks wouldn't normally go update the file on their web UI, they'd do it locally and using npm. Merging the PR seems to me a more appropriate way to do it, and has utility across any language (not just Node).