Add a cooldown period to dependabot

[gpshead]

The rational of this practice is well laid out in https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns.

[AA-Turner]

We already have a monthly interval, so E[dependency updated] is a fortnight. As such I think 14 days might be overkill?

A

[gpshead]

The monthly schedule is not a cooldown. A security cooldown means not auto-updating to a dep until that long after it's release.

[gpshead]

fixed up. i'm leaving it as 14d because with our existing monthly schedule we're already not trying to get new versions fast anyways. whenever there is an actual urgent need we'll already be making our own PR, so i'm opting to move slower by default.