CORE-69 Put sbt-setup in the right spot in dependency-graph.yml

[calypsomatic]

<your comments for this PR go here>

Have you read CONTRIBUTING.md lately? If not, do that first.

I, the developer opening this PR, do solemnly pinky swear that:

• I've followed the instructions if I've made any changes to the API, especially if they're breaking changes
• I've updated the FISMA documentation if I've made any security-related changes, including auth, encryption, or auditing

In all cases:

• Get two thumbsworth of review and PO signoff if necessary
• Verify all tests go green
• Squash and merge. Make sure your branch deletes; GitHub should do this for you.
• Test this change deployed correctly and works on dev environment after deployment