Add 3-day cooldown for Dependabot and npm

[nickrolfe]

This adds a 72-hour buffer before newly-published package versions are eligible for installation.

[Copilot]

Pull request overview

Adds a 72-hour “cooldown” to reduce exposure to newly-published dependency versions by delaying when updates are proposed (Dependabot) and when installs are allowed (npm config for the extension workspace).

Changes:

• Configure npm (for extensions/ql-vscode) to require packages to be at least 3 days old before installation.
• Add a 3-day Dependabot cooldown for npm, GitHub Actions, and Docker dependency updates.

Show a summary per file

File	Description
extensions/ql-vscode/.npmrc	Adds an npm setting intended to enforce a minimum package release age before installs.
.github/dependabot.yml	Adds a 3-day Dependabot cooldown across multiple ecosystems to delay updates for newly-published versions.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

.github/dependabot.yml:48

• The PR title/description says this change is for Dependabot and npm, but this also adds a cooldown for Docker updates. If intentional, please update the PR title/description to reflect the broader scope; otherwise, remove this block.

  - package-ecosystem: docker
    directory: "extensions/ql-vscode/test/e2e/docker"
    cooldown:
      default-days: 3
    schedule:

• Files reviewed: 2/2 changed files
• Comments generated: 1

[nickrolfe]

The "Dependabot" in the title referred to all changes in this file. The "npm" referred to the changes in .npmrc.