chore: group minor dependencies into single PR

[comphead]

Which issue does this PR close?

• Closes #.

Rationale for this change

• Reduce Dependabot PR noise without reducing coverage
  Grouping most minor and patch Cargo updates into a single PR keeps routine churn manageable while still ensuring updates are applied regularly.

• Keep riskier updates isolated
  Major version bumps can include breaking changes, so we intentionally do not group major updates. This preserves one PR per crate for majors, simplifying review, CI triage, and rollback.

• Preserve existing special handling for Arrow/Parquet

  • Arrow/Parquet updates are higher impact and often coordinated, so we keep their minor/patch updates grouped together for consistency.
  • Arrow/Parquet major bumps are handled manually (and ignored by Dependabot) to avoid surprise large-scale breakage.

• Ensure object_store and sqlparser remain easy to diagnose
  These dependencies can have outsized downstream impact in DataFusion. Excluding them from the catch-all group ensures their updates land as individual PRs, making it easier to attribute regressions and bisect failures.

• Maintain targeted grouping where it’s beneficial
  Protocol-related crates (prost*, pbjson*) are commonly updated together, so grouping their minor/patch updates reduces churn while keeping changes cohesive.

What changes are included in this PR?

Are these changes tested?

Are there any user-facing changes?