Add cooldown configuration for Dependabot

[coliff]

Description / Motivation & Context

Worthwhile security improvement which is recommended by several security tools/services.

REF: https://docs.zizmor.sh/audits/#dependabot-cooldown

Type of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Refactoring (non-breaking change)
• Breaking change (fix or feature that would change existing functionality)

Checklist

• I have read the contributing guidelines
• My code follows the code style of the project (using npm run lint)
• My change introduces changes to the documentation
• I have updated the documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed

[Copilot]

Pull request overview

Adds a Dependabot “cooldown” window to reduce update churn and improve security posture by spacing out automated dependency update PRs, aligning with external audit guidance.

Changes:

• Configure cooldown.default-days: 7 for the github-actions Dependabot updates.
• Configure cooldown.default-days: 7 for the npm Dependabot updates.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[julien-deramond]

I wasn't aware of this feature, thanks for sharing, @coliff 🙏
It looks really interesting. I'll take a closer look, along with the cooldown docs, as soon as I can 🙂