fix: align Dependabot with release quarantine

[bvolpato]

Summary

Align dependency automation with pnpm supply-chain policy and keep coupled GitHub Actions versions compatible.

Repro

Dependabot attempted Puppeteer 25.8.0 after its default three-day cooldown. pnpm rejected the lockfile update because this repository requires seven days of release age. Separate CodeQL init and analyze update PRs also created mismatched versions and failed scans.

Changes

• set npm Dependabot cooldown to seven days
• preserve pnpm minimumReleaseAge: 10080 security policy
• group GitHub Actions updates into one PR
• update both CodeQL actions to 4.37.8
• update pnpm setup action to 6.0.10

Testing

• parsed all changed automation YAML with project YAML parser
• verified npm cooldown equals seven days
• verified CodeQL init/analyze use same commit
• git diff --check
• CI and CodeQL required before merge

Did this cause any problems?

Revert these commits to restore Dependabot default behavior and previous action pins.