ci: group Dependabot updates and add npm cooldown

github-actions updates get a ci(deps) commit prefix and land as one
grouped PR. npm dev-dependency minor and patch updates are grouped;
majors and production deps stay individual so fix(deps) releases keep
working per dependency. A 3-day cooldown delays npm updates past the
window where compromised releases are typically caught and unpublished.

Author: xobotyi

.github/dependabot.yml

@@ -6,6 +6,12 @@ updates:
       interval: daily
       time: "00:00"
       timezone: "Etc/UTC"
+    commit-message:
+      prefix: "ci(deps)"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
 
   - package-ecosystem: npm
     directory: /
@@ -15,6 +21,14 @@ updates:
       timezone: "Etc/UTC"
     rebase-strategy: auto
     versioning-strategy: increase
+    cooldown:
+      default-days: 3
     commit-message:
       prefix: "fix(deps)"
       prefix-development: "chore(deps)"
+    groups:
+      dev-dependencies:
+        dependency-type: development
+        update-types:
+          - minor
+          - patch