chore: add Dependabot config with cooldown

[skonefal]

• Adds Dependabot configuration for the repository's package ecosystems.
• Monthly update schedule with a 7-day cooldown before update PRs are opened.
• Groups updates into security, minor-and-patch, and major.

[cursor]

PR Summary

Low Risk
Only adds CI dependency automation configuration; no application runtime or auth logic changes.

Overview
Adds .github/dependabot.yml so GitHub Dependabot can open dependency update PRs for gomod (repo root) and github-actions.

Both ecosystems use a monthly schedule, a 7-day cooldown before PRs open, and grouped updates: security-updates (all security bumps) and minor-and-patch (non-major version bumps).

^{Reviewed by Cursor Bugbot for commit 5fa5d59. Configure here.}