chore: bump actions/checkout to v7 + add dependabot version updates

[Copilot]

This PR updates all SHA-pinned actions/checkout references in CI from v4.2.2 to v7 and introduces Dependabot grouped version updates for every detected ecosystem in this repo. The checkout bump is explicit because SHA-pinned older refs do not inherit the July 16 safer pull_request_target backport.

• CI checkout pin refresh

  • Replaced all 3 actions/checkout pins in .github/workflows/ci.yml with 9c091bb... (v7.0.0).

• Dependabot grouped updates with cooldown

  • Added .github/dependabot.yml.
  • Configured grouped updates for:
    • github-actions
    • pip
  • Set cooldown.default-days: 7 for both ecosystems.

# .github/workflows/ci.yml
- name: Checkout code
  uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

[Copilot]

Pull request overview

This PR refreshes GitHub Actions usage by updating the pinned actions/checkout SHA in the CI workflow and adds a new Dependabot configuration to automate grouped dependency updates on a weekly cadence with a cooldown period.

Changes:

• Bumped all actions/checkout pins in .github/workflows/ci.yml to the v7.0.0 commit SHA.
• Added .github/dependabot.yml to enable grouped Dependabot version updates for GitHub Actions and Python dependencies, with a 7-day cooldown.

Show a summary per file

File	Description
.github/workflows/ci.yml	Updates the SHA-pinned actions/checkout used across CI jobs.
.github/dependabot.yml	Introduces grouped Dependabot version updates with a 7-day cooldown for configured ecosystems.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1

[felickz]

👍