chore: use dependabot cooldown period

[jkowalleck]

read https://blog.pecar.me/how-to-safely-update-your-dependencies/#update-with-cooldowns

configure dependabot docs:

• https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown- 
• https://docs.github.com/en/code-security/tutorials/secure-your-dependencies/optimizing-pr-creation-version-updates#setting-up-a-cooldown-period-for-dependency-updates

[jkowalleck]

still need to figure out which period is right for us.
I feel like 14 days - maybe 21?

maybe use diffrent settings for dev-deps and runtime-deps?

when the period is too short, we might get affected by zero-days, what we want to prevent.
If it is too long, we might not pickup downstream lib-incompatibilities on time. ....