chore(deps): add Dependabot cooldown and cap TypeScript below 7 for docs

[larsgeorge-db]

What

Two changes to .github/dependabot.yml:

1. 7-day cooldown on all six update entries. Dependabot keeps proposing versions the Databricks JFrog registry can't serve yet — either the pip mirror hasn't synced the release, or npm curation blocks it under the 7-day immaturity window. This has red-CI'd several dependency PRs (chore(deps): bump google-cloud-bigquery from 3.41.0 to 3.45.0 in /src #779 google-cloud-bigquery, chore(deps): bump mlflow from 3.15.1 to 3.16.0 in /src #777 mlflow, chore(deps): bump lucide-react from 1.16.0 to 1.41.0 in /src/frontend #773 lucide-react). A 7-day cooldown makes Dependabot wait until the registry can install the version.

2. Cap typescript below 7 for /website/ontos only. TS 7 is the native (Go) compiler rewrite that breaks the JS compiler API Docusaurus 3.x and its tooling depend on; it isn't supported yet (see chore(deps-dev): bump typescript from 5.6.3 to 7.0.2 in /website/ontos #747, which bumped to 7.0.2). The docs site has no CI to catch the break, so a bad bump merges green silently. The >=7 cap still lets Dependabot track the supported 6.x line. The main app (/src/frontend) is deliberately left free — its required TypeScript Type Check job guards it.

Notes

• The ignore is scoped to the /website/ontos npm entry, so it does not affect the main app.
• Mitigates but doesn't fully eliminate the registry-lag class of failure; mirror sync can occasionally exceed 7 days.

Closes #790

[mvkonchits-db]

Reviewed with the code-review skill — config-only, low-risk. Approving. Three non-blocking notes for your awareness:

1. The TypeScript >=7 ignore is scoped only to /website/ontos; /src/frontend (also TypeScript) has no equivalent guard, so a TS7 bump PR can still land there.
2. Dependabot ignore conditions also suppress security updates in the ignored range — a future advisory fixed only in TS >=7 would be silently blocked on the docs site (no alerting PR).
3. Worth confirming cooldown is supported for every ecosystem listed (incl. github-actions); if not, the block is a silent no-op rather than the intended 7-day delay.

None block.