chore: add Dependabot config

[CorieW]

Features and why

• Group Dependabot minor and patch updates to reduce Dependabot PRs.
• Add a 7-day minimum release age for dependency updates to reduce chance of pulling newly compromised npm packages, such as the Mini Shai-Hulud worm attack.

[gemini-code-assist]

Code Review

This pull request introduces a Dependabot configuration file (".github/dependabot.yml") to automate npm dependency updates. However, the configuration includes an invalid "cooldown" property, which will cause a schema validation error and prevent Dependabot from running. It is recommended to remove this block.

[ajperel]

Overall seems good. Thanks for the clear response to gemini review bot thinking cooldown wasn't supported.

I noticed digging into this that the github-actions workflows also pull things in. Should we configure dependabot for them as well? Or maybe that's on just us/Google and I should ask internally since we maintain more of that pipeline?