chore: Add Dependabot version-update cooldown

[ld-repository-standards]

This pull request was auto generated by the LaunchDarkly Github Standards automation platform.

• Ensure every entry under updates in .github/dependabot.yml declares a cooldown of at least 7 days (default-days).
• Add entries for detected package ecosystems that were not yet tracked by Dependabot.

Cooldown applies only to version updates; security updates bypass it, so critical CVE fixes are never delayed.

Ref: SEC-8058.

---

Note

Low Risk
CI/automation-only change to dependency update timing; no application runtime or security logic is modified.

Overview
Introduces .github/dependabot.yml to automate dependency updates across the monorepo.

Every updates entry uses a weekly schedule and a cooldown.default-days: 7 so version-update PRs are spaced out; security updates are unaffected by cooldown per Dependabot behavior.

Coverage includes github-actions (repo root), gradle for Flutter example Android trees, and pub for the root plus apps (flutter_client_contract_test_service, sse_contract_test_service) and packages (common, common_client, event_source_client, flutter_client_sdk and its examples).

^{Reviewed by Cursor Bugbot for commit c1885bb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c1885bb. Configure here.}

[cursor]

Dependabot targets missing example_fdv2

Medium Severity

Three new Dependabot updates entries point at packages/flutter_client_sdk/example_fdv2 (pub plus two Gradle paths), but that directory is not in the repository—only example/ exists under flutter_client_sdk. Dependabot will fail those jobs with missing manifest errors instead of scheduling updates.

Additional Locations (1)

• .github/dependabot.yml#L20-L32

 

^{Reviewed by Cursor Bugbot for commit c1885bb. Configure here.}