Bring the Renovate-applied dependencies and security labels under the shared taxonomy

[bryanbeverly]

Neither dependencies nor security was listed in labels.yml, so the sync never touched them and each repo kept whatever the tool that first created the label happened to set. Both come from the shared Renovate preset (renovate-config.json), not the pr-labeler.

• dependencies exists on all 12 repos but in two colors: 0366d6 with a description on 7, GitHub's default ededed with none on 4. The split is whether Dependabot ran there before the Renovate migration.
• security exists on only 7. The preset applies it from vulnerabilityAlerts, so GitHub creates it on a repo's first vulnerability PR — and the other 4 have no manifest in an ecosystem the advisory database covers, so they never get one.

Both entries take their color and description from dependabot-core's labeler.rb, where these labels originate. The gray in this org was never a choice; it is what GitHub assigns when Renovate applies a label that does not exist yet.

Next sync recolors dependencies on 4 repos, recolors security on 7, and creates security on 4. Still additive — nothing is deleted.

---

Note

Low Risk
Config-only change to label metadata; no application or security logic is modified.

Overview
Adds dependencies and security to the org’s shared labels.yml so the label-sync workflow can apply consistent colors and descriptions on the next run.

These labels are already applied by Renovate/Dependabot on many repos but were missing from the taxonomy, so some repositories kept GitHub’s default gray or inconsistent styling. The sync remains additive—it updates or creates these two labels and does not remove anything else.

^{Reviewed by Cursor Bugbot for commit c898bed. Bugbot is set up for automated code reviews on this repo. Configure here.}