Add cooldown to dependabot actions

## What is the problem or limitation you are having?

Our dependabot configuration currently upgrades all packages to the most recently available versions at the time of publication. This is a potential vector for supply chain attacks, as there's no window for a malicious release to be identified before it is rolled out. Best practice is to [add a cooldown period](https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns) to dependency updates.

## Describe the solution you'd like

We should add a 7 day cooldown to our dependabot configuration.

This has already been done to the [`beeware/.github` dependabot configuration](https://github.com/beeware/.github/blob/main/.github/dependabot.yml). We should make the analogous change to the dependabot configuration in this repository.

## Describe alternatives you've considered

Dependabot [recently added a default cooldown](https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/). However, the issue will still be identified by zizmor (and other auditing tools); and it's better to be explicit rather than implicit.

## Additional context

首先定位此 repository 的 Dependabot 配置，并将其与链接的 beeware/.github 配置进行比较。确认七天冷却期是如何表示的，然后更新 repository 配置，并确认审计工具不再报告缺少显式冷却期。

由索引模型根据 Issue 内容生成。