chore: use dependabot cooldown period

[jkowalleck]

read https://blog.pecar.me/how-to-safely-update-your-dependencies/#update-with-cooldowns

configure dependabot: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown- 

[jkowalleck]

still need to figure out which period is right for us.
I feel like 14 days - maybe 21?

when the period is too short, we might get affected by zero-days, what we want to prevent.
If it is too long, we might not pickup downstream lib-incompatibilities on time. ....