gate dependabot updates by age (#534)

Delay Dependabot PRs for `npm` updates and third-party Go modules until
new releases are at least seven days old. Keep `github.com/riverqueue/*`
and `riverqueue.com/*` Go dependencies exempt so internal packages can
still update immediately.

Author: bgentry

.github/dependabot.yml

@@ -49,11 +49,18 @@ updates:
       - riverpro-proxy
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
+      exclude:
+        - "github.com/riverqueue/*"
+        - "riverqueue.com/*"
 
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
     groups:
       production-dependencies:
         dependency-type: "production"