ci: restrict dependabot to same-major updates with 7-day cooldown

Co-Authored-By: rlamb@launchdarkly.com <4955475+kinyoklion@users.noreply.github.com>

Author: devin-ai-integration[bot]

.github/dependabot.yml

@@ -1,10 +1,28 @@
 version: 2
-updates: 
+updates:
   - package-ecosystem: "github-actions"
     directory: "/"
-    schedule: 
+    schedule:
       interval: "daily"
+    # Dependency quarantine: only adopt releases that are at least 7 days old.
+    cooldown:
+      default-days: 7
+    # Restrict version updates to the current major version. Security updates are
+    # exempt (update-types does not affect security updates), so Dependabot may
+    # still bump a major version when required to resolve a vulnerability.
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
   - package-ecosystem: "npm"
     directory: "/"
-    schedule: 
+    schedule:
       interval: "daily"
+    # Dependency quarantine: only adopt releases that are at least 7 days old.
+    cooldown:
+      default-days: 7
+    # Restrict version updates to the current major version. Security updates are
+    # exempt (update-types does not affect security updates), so Dependabot may
+    # still bump a major version when required to resolve a vulnerability.
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]