How often does the password change for the Gryffindor common room?

TL;DR Based on what we do know, as described below, it seems that password lengths could vary. Some seem to have lasted for only a couple of weeks, while others apparently lasted for several months.

In Philosopher's Stone the opening password lasted between a couple of weeks and a couple of moths. On the night of the Midnight Duel there was already a new password:

It wasn’t Mrs. Norris. It was Neville. He was curled up on the floor, fast asleep, but jerked suddenly awake as they crept nearer.

“Thank goodness you found me! I’ve been out here for hours, I couldn’t remember the new password to get in to bed.”

The chronology here is rather murky, though. The Midnight Duel occurred on the night of the flying lesson. The day of the flying lesson occurs in the book immediately after Harry's tea with Hagrid, which was at the end of the first week of school. We don't know exactly how much time elapsed between the two events, but it doesn't seem like too long.

On the other hand, the next day described after the Midnight Duel is Harry's Quidditch practice with Wood, and after that it skips to Halloween, so all we really know is that the password changed sometime after the first week of school and sometime prior to Halloween.

In Prisoner of Azkaban we have an example where a single password was in use for at least two months. The password at the beginning of the year was Caput Draconis:

“Coming through, coming through!” Percy called from behind the crowd. “The new password’s ‘Fortuna Major’!”

Two months later on Halloween that was still the password:

On Halloween morning, Harry awoke with the rest and went down to breakfast, feeling thoroughly depressed, though doing his best to act normally.

Harry ignored him and made his solitary way up the marble staircase, through the deserted corridors, and back to Gryffindor Tower. “Password?” said the Fat Lady, jerking out of a doze. “Fortuna Major,” said Harry listlessly.

In Goblet of Fire the first password was still in effect into December. The year began with Balderdash:

“Password?” she said as they approached.

“Balderdash,” said George, “a prefect downstairs told me.”

Later in the book we are told that it was already December:

The start of December brought wind and sleet to Hogwarts.

And after that the password was still Balderdash:

“Wonder where she’s got to?” Ron said as he and Harry went back to Gryffindor Tower.

“Dunno . . . balderdash.”

This password did not last much beyond that, as it had already been changed when Harry returned from asking Cho to the Yule Ball shortly before Christmas:

“Fairy lights,” he said dully to the Fat Lady — the password had been changed the previous day.

This password only lasted for about a month, though. We are first told that it was mid-January:

There was a Hogsmeade visit halfway through January.

At the end of that day they visited Hagrid, which made Harry try Cedric's suggestion for figuring out the egg clue. There is no precise date given for when he did this, but it seems to have been shortly thereafter, and there was a new password:

This time it was Ron who waited outside to give the Fat Lady the password (“banana fritters”).

In Order of the Phoenix the first password lasted more than a month. The year started with Mimbulus Mimbletonia:

“Harry, I know it!” someone panted from behind him, and he turned to see Neville jogging toward him. “Guess what it is? I’m actually going to be able to remember it for once —” He waved the stunted little cactus he had shown them on the train. “Mimbulus mimbletonia!”

There was a Hogsmeade trip in the beginning of October in which the DA started:

“Look,” she leaned toward him; Ron, who was still watching her with a frown on his face, leaned forward to listen too, “you know the first weekend in October’s a Hogsmeade weekend? How would it be if we tell anyone who’s interested to meet us in the village and we can talk it over?”

The next series of events occurred on the Monday after the Hogsmeade visit:

The knowledge that all those people did not think him a lying weirdo, but someone to be admired, buoyed him up so much that he was still cheerful on Monday morning, despite the imminent prospect of all his least favorite classes.

During that day Harry received a letter from Sirius seeting up a fireplace meeting that night:

Harry slit open the scroll as he hurried toward them and found five words in Sirius’s handwriting:

Today, same time, same place.

After Umbridge nearly caught Sirius in the fire, Harry, Ron, and Hermione discuss it in Charms class. Later that day, Harry and Ron have Quidditch practice. When they return to the common room the password is still Mimbulus Mimbletonia:

“Mimbulus mimbletonia,” said Ron’s voice and Harry came back to his senses just in time to clamber through the portrait hole into the common room.

In Half-Blood Prince the password Baubles lasted for only about a week or two. It went into effect shortly before Christmas:

“Baubles,” said Harry to the Fat Lady, this being the new, festive password.

On that same day:

Harry went to bed comforting himself that there was only one more day of lessons to struggle through, plus Slughorn’s party, after which he and Ron would depart together for the Burrow.

And when they returned to Hogwarts after Christmas there was already a new password:

“Baubles,” said Ron confidently, when they reached the Fat Lady, who was looking rather paler than usual and winced at his loud voice.

“No,” she said.

“What d’you mean, ‘no’?”

“There is a new password,” she said.

The next password that we see, Abstinence, could not have lasted longer than about four months. It was the new password after Christmas mentioned above:

“I’ve got something for you, Harry,” said Hermione, neither looking at Ron nor giving any sign that she had heard him. “Oh, hang on — password. Abstinence.”

And Harry came back from getting Slughorn's memory at Aragog's funeral the password was Tapeworm, and had apparently been so for some amount of time already:

“Come back! All right, I lied! I was annoyed you woke me up! The password’s still ‘tapeworm’!”

As Aragog's funeral was on April 21st, the password Abstinence could have at most lasted from the beginning of term after Christmas until sometime before April 21st.

The Tapeworm password was no longer in use when Harry returned to the common room after the Quidditch final:

He hesitated outside the crowded Great Hall, then ran up the marble staircase; whether Gryffindor had won or lost, the team usually celebrated or commiserated in their own common room.

“Quid agis?” he said tentatively to the Fat Lady, wondering what he would find inside.

This was presumably some time towards the end of May:

The balmy days slid gently through May, and Ron seemed to be there at Harry’s shoulder every time he saw Ginny. Harry found himself longing for a stroke of luck that would somehow cause Ron to realize that nothing would make him happier than his best friend and his sister falling for each other and to leave them alone together for longer than a few seconds. There seemed no chance of either while the final Quidditch game of the season was looming; Ron wanted to talk tactics with Harry all the time and had little thought for anything else.

This provides only about a month from when we definitively know that tapeworm was the password. Of course, Tapeworm could have gone into effect as early as shortly after the Christmas holidays; the earlier we push back Tapeworm, the shorter Abstinence would have lasted.

There are a few other passwords throughout the books that do not contain enough information to determine how long they lasted.