Add cooldown period to prevent supply-chain attacks

[emteknetnz]

• Universally add a cooldown period, probably 7 days, to our methods of updating JS to prevent supply-chain attacks
• Update relevant gha-* modules e.g. gha-upgrade-js - see https://simonwillison.net/2026/Mar/24/package-managers-need-to-cool-down/
• Update dependabot to add a cooldown period - see https://github.com/axios/axios/pull/10616/files
• https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/