fix: harden GitHub Actions workflows (zizmor)

Add dependabot cooldown configuration (default 7 days) to avoid
immediately adopting newly released action versions that may contain
undiscovered vulnerabilities.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: reberhardt7

.github/dependabot.yml

@@ -5,3 +5,5 @@ updates:
     schedule:
       interval: "weekly"
       day: "monday"
+    cooldown:
+      default-days: 7