dependency cooldown

[arielkr256]

Background

adding a cooldown to both ecosystems both to avoid constant PRs and to try to mitigate supply-chain attacks. See https://docs.zizmor.sh/audits/#dependabot-cooldown #2104 (review)

[cursor]

PR Summary

Low Risk
Dependabot-only configuration with no application or CI logic changes.

Overview
Adds a 7-day Dependabot cooldown (default-days: 7) to both the github-actions and pip update entries in .github/dependabot.yml, on top of the existing weekly schedule.

This spaces out dependency update PRs to cut noise and aligns with guidance for reducing rapid supply-chain update churn.

^{Reviewed by Cursor Bugbot for commit 8752329. Bugbot is set up for automated code reviews on this repo. Configure here.}