Let Dependabot propose a release only once it is a week old

zizmor (dependabot-cooldown) flagged both update entries in
dependabot.yml: without a cooldown, Dependabot waits only its implicit
three days before it proposes a new version of an action or a Gradle
dependency. A compromised or broken release is usually pulled within
days, and the auto-merge workflow approves minor and patch updates on
its own, so both entries now wait seven days. The cooldown applies to
version updates only; security updates are not delayed.

Author: abashev

.github/dependabot.yml

@@ -1,13 +1,19 @@
 version: 2
+# A release is proposed only once it is a week old: a compromised or broken release is usually pulled
+# within days. The cooldown holds back version updates only; security updates still come at once.
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
     target-branch: "main"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "gradle"
     directory: "/"
     schedule:
       interval: "weekly"
     target-branch: "main"
+    cooldown:
+      default-days: 7