Now that we use a wildcard to match against release branches for
backports, creation of those branches should also be locked down to
admins only.

This will check the origin remote if it exists and use that to determine
which branches exist. These branches are then used to populate CI
branches, branch protections, and dependabot.

Using this for dependabot is a new feature which allows old release
branches to get dependency updates for template-oss only.

This also updates the dependabot config to only update the root
directory instead of each workspace directory. The previous way was an
attempt to get it to work with workspaces, but wasn't used in any our
repos. Dependabot should now be able to update workspaces when
configured to use a single root directory.

Fixes #329