SECENG-347: Add 7-day Dependabot cooldown

[tomekchime]

JIRA

SECENG-347

What

Adds a 7-day cooldown to all Dependabot updaters, excluding internal packages.

Why

Supply chain attacks typically have exploitation windows of hours to days. A 7-day cooldown closes that window with zero operational cost: version updates are delayed, security updates still come through immediately.

Why cooldowns matter • GitHub cooldown docs

Created by Sourcegraph batch change tomekchime/batch-dependabot-cooldown-config.

[cursor]

PR Summary

Low Risk
Low risk config-only change that delays non-security Dependabot updates by 7 days; main impact is slower dependency bump cadence while excluding internal packages from the delay.

Overview
Adds a 7-day cooldown to Dependabot update configs for github-actions and gomod, delaying version-bump PRs by default.

Excludes internal dependencies (1debit/* and github.com/1debit/*) from the cooldown so internal package updates are not delayed.

^{Reviewed by Cursor Bugbot for commit 6707208. Bugbot is set up for automated code reviews on this repo. Configure here.}