add dependabot cooldown to prevent immediate updates

adds default-days: 7 cooldown to both updaters (github-actions, uv)
to reduce supply-chain risk from immediate-release compromises and
avoid pulling in unstable freshly-released versions (alert #3)

Author: woutervh

.github/dependabot.yml

@@ -19,6 +19,8 @@ updates:
       open-pull-requests-limit: 9
       schedule:
           interval: "weekly"
+      cooldown:
+          default-days: 7
 
     # update uv.lock file
     - package-ecosystem: "uv"
@@ -30,3 +32,5 @@ updates:
       open-pull-requests-limit: 9
       schedule:
           interval: "monthly"
+      cooldown:
+          default-days: 7