feat(ci): add dependency cooldowns for `renovate`

[gforsyth]

We originally discussed this article offline: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns

It makes the very valid point that you can avoid all manner of supply chain attacks by just waiting a little bit after your dependencies are updated to actually pull in those updated dependencies.

For renovate, we can configure this easily by adding "minimumReleaseAge": "7 days" under packageRules.

I think we should roll this out in (especially) our highly used/shared repos.

• shared-workflows (feat: config renovate to wait 7 days after dependency release before update PR shared-workflows#526 and feat(renovate): add 7-day cooldown before any updates shared-workflows#579)
• ci-imgs feat(renovate): add 7-day cooldown before any updates ci-imgs#423
• docker feat(renovate): add 7-day cooldown before any updates docker#889
• rapids.ai feat(renovate): add 7-day cooldown before any updates rapids.ai#482
• dependency-file-generator feat: add renovate cooldown period dependency-file-generator#185
• gha-token-service https://github.com/rapidsai/gha-token-service/pull/9
• shared-actions feat(renovate): add 7-day cooldown before any updates shared-actions#119
• ops-bot https://github.com/rapidsai/ops-bot/pull/248
• downloads https://github.com/rapidsai/downloads/pull/134

No other active repos using a renovate config: https://github.com/search?q=org%3Arapidsai%20renovate.json&type=code

[jameslamb]

I support this!

Others?

1. zizmor should enforce this for any repos with a dependabot.yaml (Add zizmor to all RAPIDS projects and address all warnings #275)
2. I think we should do this for every repo with a renovate.json (GitHub search)

[gforsyth]

This is done.