Ignore /fixtures for dependabot (#28422)

We'll keep these up to date out of band, they are just for testing and
don't ship in the npm packages.