so that dependabot can access the constraints file and automatically
create security PRs; it fails if the constraints file is specified via
remote URL.