Stop dependabot proposing slf4j 2.x and guice 6+ on 4.x

[slachiewicz]

The 4.x line tracks the Maven 3.9 runtime, so two dependabot proposals can never be accepted there:

• slf4j 1.7.x comes from the core realm, so compiling against the 2.0.x API is unbacked at runtime. Bumped in Bump slf4jVersion from 1.7.36 to 2.0.18 #463, reverted in Revert slf4j bump to 2.0.18 on the 4.x line #469.
• Maven still embeds Guice 5.1.0 on javax.inject, and Guice 7 dropped javax.inject entirely. Guice 6.x or 7.x would exercise a container no consumer runs. Closed on 4.x in Bump com.google.inject:guice from 5.1.0 to 7.0.0 #460, and twice before on master in Bump guice from 5.1.0 to 7.0.0 #276 and Bump com.google.inject:guice from 5.1.0 to 7.0.0 #425.

Range syntax follows maven and maven-resolver, which already ignore org.slf4j:* at [2.0.0,).

The config only takes effect from the default branch, which is why this PR targets master. The master entry is deliberately unchanged, so #458 stays open for a decision on its own merits.

This change was created with AI assistance.