chore: add dependabot cooldown settings to mitigate ongoing supply chain attacks

[Tethik]

Summary

Adds cooldown configuration to every package ecosystem in .github/dependabot.yml to reduce exposure to ongoing supply chain attacks by limiting how quickly compromised or malicious package versions can be automatically adopted.

• default-days: 7 — general cooldown between updates
• semver-major-days: 30 — slow down disruptive major bumps
• semver-minor-days: 7 — moderate cadence for minor releases
• semver-patch-days: 3 — quick turnaround for patch/security fixes

Test plan

• Verify dependabot.yml is valid YAML after the change
• Confirm all updates entries now contain a cooldown block