Update dependabot cooldown

[kondratevdev]

Hi! Thanks for the great library! We'd love to try it out in production. I'd also be happy to contribute to its development and share our experience along the way :)

• What and why:
  Added zizmor to improve the security of GitHub Actions workflows by detecting common security issues and potentially dangerous configurations
  Added a cooldown configuration to reduce update noise and provide a safety window for potentially compromised releases to be discovered before adoption
• Tests:
  Not needed
• Changelog:
  Not user-visible

[PhiLily]

Thanks, and good to hear you're looking at it for production.
If anything gets in your way there, please open an issue or ping me.

The cooldown is a good idea and I'd like to merge it :)

I'd leave the zizmor part out of this PR, for two reasons:

1. Nothing runs zizmor yet. No workflow calls it, so the config file on its own doesn't check anything.
2. "*": ref-pin loosens the default. With no * rule, zizmor requires a hash pin for every action, and every action here is already pinned to a SHA. This setting would let a tag pin through, including on pypa/gh-action-pypi-publish in the release job.

I'd also prefer to keep secrets-outside-env on and act on what it flags than switch it off.

Could you drop .github/zizmor.yml and keep this PR to the cooldown?
*I'll add a zizmor job separately. CI is waiting on approval, and I'll start it once you've pushed.

Thanks! @kondratevdev 👑

[kondratevdev]

Thanks, and good to hear you're looking at it for production. If anything gets in your way there, please open an issue or ping me.

The cooldown is a good idea and I'd like to merge it :)

I'd leave the zizmor part out of this PR, for two reasons:

1. Nothing runs zizmor yet. No workflow calls it, so the config file on its own doesn't check anything.

2. `"*": ref-pin` loosens the default. With no `*` rule, zizmor requires a hash pin for every action, and every action here is already pinned to a SHA. This setting would let a tag pin through, including on `pypa/gh-action-pypi-publish` in the release job.

I'd also prefer to keep secrets-outside-env on and act on what it flags than switch it off.

Could you drop .github/zizmor.yml and keep this PR to the cooldown? *I'll add a zizmor job separately. CI is waiting on approval, and I'll start it once you've pushed.

Thanks! @kondratevdev 👑

Sure! Thank you for feedback!

[PhiLily]

@kondratevdev I opened #48 for the zizmor job, in case you would like to take it. No pressure either way.