chore(dependabot): raise semver-patch cooldown to 5 days (#33)

Patch is the only update class that auto-merges with no human
involved, yet carried the shortest cooldown (1 day, a third of
GitHub's 3-day default). Soak time should scale with how little
scrutiny a bump receives, not with how breaking semver claims it is.

Costs nothing in security terms: cooldown never applies to Dependabot
security updates, which still fire immediately.

Propagated from simplify9/.github (dependabot-templates).

Merge pull request #30 from simplify9/feature/typed-error-body-and-pe…

…r-call-builder

fix: scope dependabot-auto-merge's critical-vuln-gate check to main-b…

…ound PRs only

fix: use pull_request_target so vuln-gate/auto-merge work on real Dep…

…endabot PRs

chore: add Dependabot configuration and critical-vuln gate (#16)

Co-authored-by: dependabot-rollout-bot <devops@simplify9.com>

Update nuget-publish.yml

Merge pull request #15 from simplify9/muhannad/nuget-upgrade

remove unnecessary newline in SW.HttpExtensions.csproj

Merge pull request #14 from simplify9/omarghatasheh-patch-1

Update nuget-publish.yml

github actions and docs updated