ci: reduce dependabot PR noise with groups and cooldown

[zastrowm]

Summary

Dependabot is currently opening ~20 individual PRs per update cycle, creating significant maintenance overhead. This adds:

• Dependency groups — batches related updates into fewer PRs (dev deps together, production minor+patch together, all GH Actions together)
• Cooldown periods — rate-limits how frequently new version-update PRs are opened (major: 30d, minor: 7d, patch: 3d)

Expected reduction: ~20 PRs → ~7 PRs per cycle (~65% fewer).

Security updates are unaffected — they bypass cooldown and grouping, so CVE patches still get immediate, dedicated PRs.

Follows the same pattern used in strands-agents/harness-sdk.

Test plan

• Verify dependabot picks up the new config on next scheduled run
• Confirm grouped PRs appear (e.g. "ci(rust): bump the production-minor group")
• Confirm security advisories still get immediate standalone PRs