Fix dependabot config: weekly schedule, cooldown, missing ecosystems

[dguido]

Summary

• Change all schedules from daily to weekly
• Add cooldown: default-days: 7 for supply chain safety (delays adoption of newly published versions)
• Add grouped updates with patterns: ["*"] to batch PRs per ecosystem
• Consolidate cargo: root workspace / covers ruby, rust, and shared extractors
• Add missing ecosystem coverage: npm (javascript/extractor), pip (python/extractor + misc/codegen), nuget (csharp/extractor)
• Remove redundant gomod test directory entry (was ignoring all deps via ignore: ["*"])

Test plan

• Verify dependabot.yml passes GitHub's schema validation after merge
• Confirm Dependabot creates grouped PRs for newly covered ecosystems within one week

🤖 Generated with Claude Code