Dependabot updates default to three-day cooldown

This is a highly practical default shift that prioritizes supply chain security over bleeding-edge dependency updates.

* **Proactive Security Gate:** Delaying minor and major version updates by three days provides a critical window for malicious packages or accidental bugs to be detected and retracted before they impact downstream repositories.

* **Excluding Security Patches:** Critical security updates will continue to be opened immediately to ensure active vulnerabilities are addressed without delay.

* **Granular Customization:** Organizations can still configure or bypass this cooldown window using the `cooldown` parameter in their `.github/dependabot.yml` configuration files.