Add a 7-day cooldown to the Dependabot config

Flagged by this repo's own Semgrep scan on the previous commit
(package_managers.dependabot.dependabot-missing-cooldown): without a cooldown,
Dependabot proposes a version the moment it is published, which is exactly the
window a hijacked release exploits. Compromised releases are typically yanked
within a few days, so wait 7.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: 07souravkunda

.github/dependabot.yml

@@ -13,3 +13,7 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 5
+    # Don't propose a version the day it is published: a compromised or hijacked release
+    # is usually caught and yanked within a few days. Same reasoning as the digest pin.
+    cooldown:
+      default-days: 7