ci(dependabot): wait 7 days before proposing new versions

Dependabot proposed new versions of actions and `pre-commit` hooks on
its first scheduled run after their release, waiting only for the
3-day cooldown it now applies by default. A compromised or broken
release is often found and pulled within days, so a longer wait gives
a better chance of never being offered one.

Set `cooldown.default-days: 7` for both ecosystems, so a release is
not proposed until 7 days after it is published. GitHub's Dependabot
options reference lists both GitHub Actions and `pre-commit` as
supporting `default-days`. (Neither supports the per-semver-level
`semver-*-days` settings, which are not needed here.) When `pre-commit`
updates were first set up, its ecosystem did not support `cooldown`,
so it was left out then; now it does.

The cooldown applies only to version updates. Dependabot security
updates, where enabled, are not delayed by it.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: EliahKagan

.github/dependabot.yml

@@ -4,11 +4,15 @@ updates:
   directory: "/"
   schedule:
     interval: weekly
+  cooldown:
+    default-days: 7
 
 - package-ecosystem: pre-commit
   directory: "/"
   schedule:
     interval: monthly
+  cooldown:
+    default-days: 7
   groups:
     pre-commit:
       patterns: ["*"]