[Gerry Tan (gerrytan)]

This PR improved / fixes problem I found in dependabot.yml after reviewing recent PRs:

1. github-actions package ecosystem should not do major version bump, because there is no CI workflow to check if it work, and it's not necessary to implement one
2. Apply 7 days cooldown to gomod ecosystem to reduce risk of zero day supply chain attack
3. Reduce gomod interval to weekly to conserve resources, we don't need to check every day for this repo

Testing

Checked the schema is valid using:

curl -sSL -o /tmp/dependabot-2.0.json https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/dependabot-2.0.json
npx -y ajv-cli@5 validate --spec=draft7 --strict=false -s /tmp/dependabot-2.0.json -d .github/dependabot.yml

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Gerry Tan (gerrytan)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[v-yhyeo0202]

Thanks Gerry Tan (@gerrytan) for the PR. I have run the testing schema locally and check the GitHub check. LGTM👍