Add cooldown to dependabot actions

## What is the problem or limitation you are having?

Our dependabot configuration currently upgrades all packages to the most recently available versions at the time of publication. This is a potential vector for supply chain attacks, as there's no window for a malicious release to be identified before it is rolled out. Best practice is to [add a cooldown period](https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns) to dependency updates.

## Describe the solution you'd like

We should add a 7 day cooldown to our dependabot configuration.

This has already been done to the [`beeware/.github` dependabot configuration](https://github.com/beeware/.github/blob/main/.github/dependabot.yml). We should make the analogous change to the dependabot configuration in this repository.

## Describe alternatives you've considered

Dependabot [recently added a default cooldown](https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/). However, the issue will still be identified by zizmor (and other auditing tools); and it's better to be explicit rather than implicit.

## Additional context

Start by locating this repository's Dependabot configuration and compare it with the linked beeware/.github configuration. Verify how the seven-day cooldown is represented, then update the repository configuration and confirm that auditing tools no longer report the missing explicit cooldown.

Written by the indexing model from the issue text.