ci: group dependabot minor and patch updates

.github/dependabot.yml

@@ -18,13 +18,34 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
+    # Let a release sit before adopting it, narrowing the window in which a
+    # compromised or immediately-yanked version can be pulled in.
+    cooldown:
+      default-days: 7
+      semver-major-days: 14
+      semver-minor-days: 7
+      semver-patch-days: 3
     open-pull-requests-limit: 10
     commit-message:
       prefix: chore(deps)
+    # Collapse routine minor/patch bumps into a single PR per ecosystem.
+    # Majors stay on their own so they still get individual review.
+    groups:
+      gradle-minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
   - package-ecosystem: "github-actions"
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
+    # Let a release sit before adopting it, narrowing the window in which a
+    # compromised or immediately-yanked version can be pulled in.
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 10
     commit-message:
       prefix: chore(deps)
+    groups:
+      github-actions-minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]