chore: adopt shared Renovate config and workflows

[desruc]

Replaces our own Renovate config and workflows with the shared team-bmbb-renovate-config.

• renovate-config.js now just extends github-action.json5 and allows its build command.
• renovate.yml replaces update-dependencies.yml and calls the shared reusable workflow.
• renovate-approve.yml replaces renovate-pull-request-automation.yml. The old one checked for Octobob, but Renovate opens PRs as team-github-bot, so it never approved anything.

Unchanged

• 2-day minimumReleaseAge for npm
• Exact version pinning
• dist/ rebuilt in the PR after each update
• Merge-confidence badges
• Runs nightly at 1:30am

Stricter

• The build command allowlist is just npm ci --ignore-scripts && npm run build, instead of .*.
• Third-party actions are pinned to a commit SHA. actions/** and OctopusDeploy/** aren't.
• Renovate's version is pinned, instead of following the action's floating tag.
• Only the npm and github-actions managers are enabled.
• Pin/digest PRs carry a note to check the SHA is at least 2 days old before merging.
• minimumReleaseAge now applies to GitHub Actions updates too.

Looser

• Dev dependency and GitHub Actions minor/patch updates auto-merge. typescript, esbuild and @vercel/ncc don't, because they build dist/. The bot only approves a PR whose body says "Automerge: Enabled", and its approval is dismissed if anyone other than Renovate pushes to the branch. RENOVATE_AUTOMERGE_PAUSED pauses new approvals.
• Major updates are no longer disabled. Node majors are grouped with @types/node, with a note to update action.yml.
• Up to 5 new PRs an hour, instead of 2.

Other changes

• Runs at 1:30am Brisbane time (previously 1:30am UTC).
• OSV vulnerability alerts are on, and vulnerability PRs get a security label.
• PRs get a dependencies label and request team-big-mouth-billy-bass as reviewers.
• PRs are only rebased when they conflict, or when an auto-merge PR falls behind main. Previously every stale PR was rebased.
• Manual runs are no longer offered as dry runs.