Add min package age to configs

After the [recent attacks on NPM packages](https://tanstack.com/blog/npm-supply-chain-compromise-postmortem), I started adding a min package age to all my projects of at least 2 days. More about this on https://chrispennington.dev/blog/stop-installing-packages-the-second-theyre-published I suggest we do the same for iD and id-tagging-schema. For Dependabot we could add [`default-days: 5`](https://docs.github.com/de/code-security/tutorials/secure-your-dependencies/optimizing-pr-creation-version-updates) to https://github.com/openstreetmap/iD/blob/develop/.github/dependabot.yml#L11