ci: reduce overlapping Dependabot PR noise

[FunKite]

Summary

• add a short cooldown for Cargo version updates so routine bumps do not race security PRs
• add an explicit Cargo security-updates group so future alerts consolidate more cleanly
• update CHANGELOG.md under Unreleased

Why

This reduces the chance of duplicate PRs like the concurrent lz4_flex 0.12.1 security fix and 0.13.0 version bump.

Validation

• ruby -e 'require "yaml"; YAML.load_file(".github/dependabot.yml")'