[binderator] Don't bump dependencies when running dotnet cake -t=bump-config

[jpobst]

Now that AndroidX and GPS are combined, the remaining config.json entries that are "dependencyOnly": true are all fixed required versions that should not be updated by the update or bump commands.

Additionally, use the comments field to document why each dependency is listed, as ideally we would like to get to a point where no old fixed versions are required.