ci: Dependabot security-updates-only + 7-day cooldown

[yurynix]

Why

The current Dependabot config chases every version bump with no cooldown, which produced 11 open non-security PRs. Switch to the org policy: security updates only, with a 7-day cooldown (matching vite-plugin and the apper templates).

What

Replaces .github/dependabot.yml:

• open-pull-requests-limit: 0 → no routine version-bump PRs (no chase-latest, no majors).
• Dependabot security updates ignore that limit and still flow (need Dependabot alerts enabled in Settings → Security).
• cooldown: default-days: 7 supply-chain buffer; groups batch minor/patch (both forward-compatible).

After this merges, the existing 11 version-bump PRs won't be recreated. base44-dev/dependency-security-bot analyzes the security PRs (root cause + CVE/GHSA, risk) and flags them to a human.

🤖 Generated with Claude Code

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/sdk@0.8.39-pr.233.2133c1f

Prefer not to change any import paths? Install using npm alias so your code still imports @base44/sdk:

npm i "@base44/sdk@npm:@base44-preview/sdk@0.8.39-pr.233.2133c1f"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "@base44/sdk": "npm:@base44-preview/sdk@0.8.39-pr.233.2133c1f"
  }
}

• 📦 Preview Package: @base44-preview/sdk@0.8.39-pr.233.2133c1f
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}