Limit Dependabot Go module updates to security advisories only

.github/dependabot.yml

@@ -373,7 +373,9 @@ updates:
 
   - package-ecosystem: "gomod"
     cooldown:
-      default-days: 4
+      # Longer than other ecosystems: distributed Go releases are not pre-scanned by a
+      # central registry, so we give any malicious release more time to be flagged.
+      default-days: 14
     directory: "/go-sdk"
     schedule:
       interval: "weekly"
@@ -404,16 +406,21 @@ updates:
           - "*"
         applies-to: security-updates
 
+  # Go modules resolve straight to upstream repositories: there is no central registry
+  # (unlike PyPI/npm) that pre-scans a release, and whoever controls a module's namespace
+  # can publish a version at any time. To keep an unreviewed upstream Go release from being
+  # auto-merged into our dev/CI chain, we do NOT raise automatic version-update PRs here
+  # (`open-pull-requests-limit: 0`); routine Go bumps are done manually. We still accept
+  # advisory-driven security updates, which require a published GHSA advisory and so cannot
+  # be triggered by an upstream release self-declaring itself a "security" fix.
   - package-ecosystem: "gomod"
     cooldown:
-      default-days: 4
+      default-days: 14
     directory: "/go-sdk"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 0
     groups:
-      go-sdk-dependency-updates:
-        patterns:
-          - "*"
       go-sdk-security-updates:
         patterns:
           - "*"