ci: restrict dependabot to same-major updates with 7-day cooldown

Co-Authored-By: rlamb@launchdarkly.com <4955475+kinyoklion@users.noreply.github.com>

Author: devin-ai-integration[bot]

.github/dependabot.yml

@@ -4,11 +4,25 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    # Dependency quarantine: only adopt releases that are at least 7 days old.
     cooldown:
       default-days: 7
+    # Restrict version updates to the current major version. Security updates are
+    # exempt (update-types does not affect security updates), so Dependabot may
+    # still bump a major version when required to resolve a vulnerability.
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "daily"
+    # Dependency quarantine: only adopt releases that are at least 7 days old.
     cooldown:
       default-days: 7
+    # Restrict version updates to the current major version. Security updates are
+    # exempt (update-types does not affect security updates), so Dependabot may
+    # still bump a major version when required to resolve a vulnerability.
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]