feat(ci): add dependency cooldowns for `renovate`

[gforsyth]

We originally discussed this article offline: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns

It makes the very valid point that you can avoid all manner of supply chain attacks by just waiting a little bit after your dependencies are updated to actually pull in those updated dependencies.

For renovate, we can configure this easily by adding "minimumReleaseAge": "7 days" under packageRules.

I think we should roll this out in (especially) our highly used/shared repos.

• shared-workflows (feat: config renovate to wait 7 days after dependency release before update PR shared-workflows#526)
• ci-imgs

Others?

[jameslamb]

I support this!

Others?

1. zizmor should enforce this for any repos with a dependabot.yaml (Add zizmor to all RAPIDS projects and address all warnings #275)
2. I think we should do this for every repo with a renovate.json (GitHub search)