Add dependency cooldown configuration

[chrisns]

Summary

• Adds a 7-day dependency cooldown to all package ecosystems in dependabot configuration

Why?

Dependency cooldowns delay automatic updates for a configurable period after a new version is published. This mitigates supply chain attacks by giving the security community time to identify and report malicious packages before they're adopted.

Empirical data shows that the vast majority of supply chain attacks have a window of opportunity of less than 7 days — a 7-day cooldown would have prevented ~80% of recent high-profile attacks (xz-utils, tj-actions, Ultralytics, etc.).

Read more: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns

Changes

• Added cooldown: default-days: 7 to every package-ecosystem entry in .github/dependabot.yml
• Security updates are NOT affected by cooldowns (only version updates)