Do not auto-approve dependabot PRs, and add cooldown to dependabot

.github/dependabot.yml

@@ -7,6 +7,8 @@ updates:
       time: "03:00"
     labels:
       - "kind/dependencies"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "cargo"
     directory: "/"
     schedule:
@@ -15,6 +17,8 @@ updates:
     labels:
       - "kind/dependencies"
     open-pull-requests-limit: 20
+    cooldown:
+      default-days: 7
   - package-ecosystem: "cargo"
     directory: "/src/tests/rust_guests"
     schedule:
@@ -24,3 +28,5 @@ updates:
       - "kind/dependencies"
       - "area/guest"
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7

.github/workflows/dep_update_guest_locks.yml

@@ -27,7 +27,6 @@ jobs:
     timeout-minutes: 15
     steps:
       # Get GitHub App token for pushing commits back to the PR
-      # Uses the same app as auto-merge-dependabot.yml
       - name: Get GitHub App token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
         id: get-app-token