Infra: Implement dependabot dependency cooldown

[Copilot]

• Breaking change? (if so, please describe the impact and migration path for existing application instances)

What changes did you make? (Give an overview)

Added cooldown configuration to all package ecosystems in dependabot.yml to limit update frequency:

• gradle, docker, github-actions: P1D (1 day)
• npm: P3D (3 days) - longer due to supply chain attack vectors

The cooldown option is correctly placed inside the schedule block for each ecosystem as per GitHub's dependabot documentation. Security patches continue to be raised immediately by dependabot regardless of cooldown settings.

Is there anything you'd like reviewers to focus on?

Verify the cooldown durations align with team preferences, particularly the 3-day npm cooldown.

How Has This Been Tested? (put an "x" (case-sensitive!) next to an item)

• No need to
• Manually (please, describe, if necessary)
• Unit checks
• Integration checks
• Covered by existing automation

Checklist (put an "x" (case-sensitive!) next to all the items, otherwise the build will fail)

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (e.g. ENVIRONMENT VARIABLES)
• My changes generate no new warnings (e.g. Sonar is happy)
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged

Check out Contributing and Code of Conduct

A picture of a cute animal (not mandatory but encouraged)

• Fixes Infra: Implement dependabot dependency cooldown #1521

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Infra: Implement dependabot dependency cooldown</issue_title>
<issue_description>Docs: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown-

• For all types of dependencies. Maybe longer for frontend ones, as NPM is more susceptible to supply chain attacks
• Security patches will be raise as a separate PR by dependabot anyway, so no need to worry about it</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Infra: Implement dependabot dependency cooldown #1521

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Haarolean]

@copilot get rid of made-up syntax, check the issue-linked docs, make dependabot syntax validation job pass

[Copilot]

@copilot get rid of made-up syntax, check the issue-linked docs, make dependabot syntax validation job pass

Fixed in commit 204972e. Moved cooldown from top-level to inside the schedule block per GitHub's documentation. All four ecosystems now have cooldown correctly configured within their schedule blocks.