dependabot: try enabling cooldown again

[cho-m]

May want to try this again to see what is state of cooldown feature since previous attempt

• dependabot: remove cooldowns #342

For now, using minimum requirement expected by Zizmor (i.e. 4 days)

• https://docs.zizmor.sh/audits/#remediation_6

Supposedly should default to all files without include but not sure given it didn't work last time.

---

I see fixes like dependabot/dependabot-core@7da4bdd which could help as it may have used semver-major-days (14 previously configured) for all Bundler updates,

          # Get maximum cooldown days based on semver parts
          days = [cooldown.default_days, cooldown.semver_major_days].max
          days = cooldown.semver_minor_days unless days > cooldown.semver_minor_days
          days = cooldown.semver_patch_days unless days > cooldown.semver_patch_days

[Copilot]

Pull request overview

This PR re-enables the Dependabot cooldown feature that was previously attempted in PR #342. It adds a 4-day cooldown period (the minimum required by Zizmor) to prevent Dependabot from creating too many PRs in rapid succession when new dependency versions are released.

• Adds cooldown configuration with default-days: 4 to all package ecosystems
• Addresses previous issues that may have been fixed in recent Dependabot updates

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[p-linnane]

Worth trying again. We'll need to monitor when the jobs run. Last time they kept showing no updates after filtering.

[woodruffw]

LGTM!

I've been considering increasing the minimum default cooldown in zizmor to 7 days, so you might want to get ahead of that here (or configure it explicitly so you don't get nagged).

[MikeMcQuaid]

I've been considering increasing the minimum default cooldown in zizmor to 7 days, so you might want to get ahead of that here (or configure it explicitly so you don't get nagged).

👍🏻 to me to do 7 days.

[cho-m]

Updated to 7 days.

Unrelated to this, but not sure if Terraform section is doing anything, at least after repo merge, as the directory layout changed.