ci(dependabot): add 7-day cooldown and group updates to reduce PR noise

Author: MarketDataApp

.github/dependabot.yml

@@ -1,5 +1,5 @@
 # Please see the documentation for all configuration options:
-# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
 
 version: 2
 updates:
@@ -8,12 +8,30 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    # Only pick up releases at least 7 days old, so brand-new
+    # (and occasionally yanked/broken) releases settle first.
+    cooldown:
+      default-days: 7
+    # Bundle all action bumps into a single PR.
+    groups:
+      github-actions:
+        patterns:
+          - "*"
     labels:
       - "dependencies"
 
   - package-ecosystem: "composer"
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
+    # One PR for minor/patch bumps; majors stay separate PRs since
+    # they can break consumers and need individual review.
+    groups:
+      composer-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
     labels:
       - "dependencies"