chore: add semver cooldowns to dependabot configuration and fix tycho-version tracking

.github/dependabot.yml

@@ -1,11 +1,36 @@
+# GitHub Dependabot configuration file
+
 version: 2
 updates:
+  # Use semver-specific cooldowns to reduce noise from freshly released packages.
+  # Keep patch/minor updates reasonably current with a short delay, but postpone
+  # major-version PRs much longer since we usually only upgrade majors intentionally.
+  # Dependabot security updates are handled separately from version-update cooldowns.
+  # Keep the daily schedule so Dependabot still checks frequently.
+  # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown
+
+  # Maintain dependencies for GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "daily"
 
+  # Maintain dependencies for maven
   - package-ecosystem: "maven"
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      semver-patch-days: 3
+      semver-minor-days: 3
+      semver-major-days: 30
+
+  # Maintain dependencies for bundler
+  - package-ecosystem: "bundler"
+    directory: "/_doc"
+    schedule:
+      interval: "daily"
+    cooldown:
+      semver-patch-days: 3
+      semver-minor-days: 3
+      semver-major-days: 30

.mvn/maven.config

@@ -1,4 +1,3 @@
--Dtycho-version=5.0.2
 -s.mvn/settings.xml
 -t.mvn/toolchains.xml
 -T4

pom.xml

@@ -10,6 +10,7 @@
 
   <properties>
     <!-- plugin version -->
+    <tycho-version>5.0.2</tycho-version>
     <artifactory-maven-plugin-version>3.6.1</artifactory-maven-plugin-version>
     <jacoco-maven-plugin-version>0.8.12</jacoco-maven-plugin-version>
     <maven-deploy-plugin-version>3.1.2</maven-deploy-plugin-version>