ci: fix zizmor findings

[acidghost]

No description provided.

[Copilot]

Pull request overview

This PR addresses security and operational findings from zizmor (a GitHub Actions security auditing tool) by implementing recommended security hardening measures and dependency management improvements.

Changes:

• Added persist-credentials: false to checkout actions in CI and release workflows to prevent credential leakage
• Disabled Go module caching in the release workflow to avoid conflicts with goreleaser's built-in caching
• Added cooldown periods to Dependabot configuration to reduce update frequency and PR volume

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/release.yml	Added security hardening (persist-credentials: false) and disabled setup-go cache to avoid conflicts with goreleaser-action
.github/workflows/ci.yml	Added security hardening (persist-credentials: false) to checkout action
.github/dependabot.yml	Added 7-day cooldown periods to all package ecosystems to manage update frequency

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.