Add dependabot cooldown

[p-r-a-v-i-n]

from docs

By default, Dependabot does not perform any "cooldown" on dependency updates. In other words, a regularly scheduled Dependabot run may perform an update on a dependency that was just released moments before the run began. This presents both stability and supply-chain security risks:
Stability: updating to the newest version of a dependency immediately after its release increases the risk of breakage, since new releases may contain regressions or other issues that other users have not yet discovered.
Supply-chain security: package compromises are frequently opportunistic, meaning that the attacker expects to have their compromised version taken down by the packaging ecosystem relatively quickly. Updating immediately to a newly released version increases the risk of automatically pulling in a compromised version before it can be taken down.

To mitigate these risks, Dependabot supports per-updater cooldown settings.

source: https://docs.zizmor.sh/audits/#dependabot-cooldown