Add cooldown to Dependabot version upgrades

Cooldowns give package repository maintainers time to mitigate supply
chain attacks before those attacks reach us. The period of 7 days was
chosen based on some informal research in the blog post that motivated
this change.

https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns

Author: chris-janidlo

.github/dependabot.yml

@@ -5,7 +5,11 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7