Measure quarantine from createdAt

[pbrisbin]

Measure quarantine from createdAt, not updateAt

b1e2fbe

Closes #14. See the Issue for explanation of why this is OK and
preferred.

Only comment on PR opened events

1f6df94

Since we're measuring from createdAt, updates don't reset the close.

Update documentation for opened-only usage

5fc9b12

[pbrisbin]

I can't decide if this should be a major version bump or not. It's a very meaningful behavior change. But, if we believe what we're saying about Dependabot's behavior updating PRs, and that using updatedAt was entirely unnecessary, then it could be considered a bug fix.

Making it a major bump is annoying because we have to update all the @v1's to get it. But if we're wrong, and the switch to createdAt actually has impact we're not thinking about (but that we still prefer), signalling that via major is the safer bet.

WDYT @joris974 ?

[joris974]

Based on your arguments and on the fact that this will change the behavior described in the Readme, IMO it will be safer to bump the major.

When configured this way, Mergeabot will run when the PR is opened or updated, so it can let you know that the updates have reset the clock on the quarantine: