Add per-language supply chain attack prevention via default cooldowns

[pid1]

Require cooldowns or minimum release ages before updating to newly published package versions.

This covers:

• Dependabot
• Renovate
• pnpm
• uv
• bun

Additionally, detect unpinned dependencies in Python scripts using uv’s inline script metadata format.

[CLAassistant]

All committers have signed the CLA.

[diptendur2c]

pnpm minimumReleaseAge was introduced in v10, would it not be FP for < 10 ? May be we can edit the message?

[0xDC0DE]

You currently don't have a lot of ok testcases. We usually expect at least one for each rule, could you take a look at adding these?

[0xDC0DE]

Overall, very useful contribution and well authored rules. Metadata and messages are great, path scoping is good.
🥇 Thanks for contributing, let's see if we can resolve the open comments and merge.

[pid1]

@diptendur2c That was explicitly removed as per this feedback.

[pid1]

@diptendur2c updated the pnpm phrasing and @0xDC0DE addressed your feedback RE ok cases.

[0xDC0DE]

Thanks for this contribution, Jonathan. You were ahead of the curve in identifying cooldown rules as important, and the metadata and messaging across your rules are well done.

Since your PR was opened, however, we received an overlapping PR in #3805 that covers much of the same ground. After comparing both, I've decided to move forward with #3805 as the base because it uses language-aware parsers (yaml, json) instead of generic for structured config files, and validates that cooldown values meet a minimum threshold rather than only checking presence/absence (e.g., minimumReleaseAge: 0 would pass the generic + pattern-not-regex approach but is caught by the metavariable-comparison approach).

That said, your PR has two rules that #3805 does not cover:

npmrc-missing-min-release-age
uv-script-unpinned-dependency
We'd like to incorporate both of these. Would you be open to submitting them as a separate, smaller PR once #3805 is merged? You can ping me for review.

Thank you again for the contribution and for driving the discussion on this topic.