Draft: repo-level Renovate configuration

[NickJosevski]

Background

Renovate has been installed since January and has never raised a PR. The schedule in
renovate-dependencies.yml is commented out and renovate.json holds nothing but a schema
reference. Every dependency bump in the history was written by hand, including the ones that
closed advisories.

Dependabot fills part of that gap on paper. Its PRs never build, though. The pullRequests
build feature on the Calamari GitHub Configuration template filters to MEMBER, and
dependabot is not an org member, so its branches get GitGuardian and the CLA check and
nothing from TeamCity. Twelve of its PRs have been raised and none merged. Self hosted
Renovate raises PRs as the account behind RENOVATE_GITHUB_TOKEN, which reaches the full
chain when that account is a member.

Results

• Weekly run, with advisories on their own schedule and a security label.
• osvVulnerabilityAlerts adds the OSV database on top of GitHub's alerts.
• The AWS SDK, the Azure SDK, the NuGet client, Serilog, and the test dependencies each land
  as one PR rather than one per package.
• Majors queue on the dependency dashboard for approval.
• Deployment fixtures under Calamari.Tests/Fixtures and the publish output are ignored.
• Workflow actions update monthly and pin by digest, matching the existing pin on
  renovatebot/github-action.
• No automerge.

Validated with renovate-config-validator.

How to review this PR

General quality. The one judgement call is the grouping, which trades PR count for review
granularity.

Reducing risk

• Nothing runs from this PR. The scheduled trigger stays commented out.
• Confirm RENOVATE_GITHUB_TOKEN belongs to an org member before turning the schedule on.
  A non member token reproduces the Dependabot dead end.
• The Octopus group stays quiet until the runner has feedz.io credentials. Most of those
  packages resolve from that feed.
• global.json is out of scope. The dotnet-sdk manager is absent from enabledManagers in
  renovate-config.js.
• Release branches are out of scope. This config targets main, so backports stay manual.