chore: add renovatebot config for updating LTS releases

[Copilot]

Renovatebot has no visibility into the LTS CRS version variables, so previous-lts-crs-version and v4-lts-crs-version are never auto-updated. This adds the necessary annotations and constraints to bring them under renovate management.

Changes

• docker-bake.hcl — Added renovate: inline comments to both LTS variables, using distinct depName values (coreruleset-v3-lts, coreruleset-v4-lts) so they can be targeted by separate package rules:

variable "previous-lts-crs-version" {
    # renovate: depName=coreruleset-v3-lts packageName=coreruleset/coreruleset datasource=github-releases
    default = "3.3.9"
}

variable "v4-lts-crs-version" {
    # renovate: depName=coreruleset-v4-lts packageName=coreruleset/coreruleset datasource=github-releases
    default = "4.25.0"
}

• renovate.json — Added two package rules pinning each LTS dep to its current minor range, so renovate only proposes patch updates within the active LTS branch:

{ "matchDepNames": ["coreruleset-v3-lts"], "allowedVersions": ">=3.3.0 <3.4.0", ... },
{ "matchDepNames": ["coreruleset-v4-lts"], "allowedVersions": ">=4.25.0 <4.26.0", ... }

Note: When an LTS minor branch advances (e.g. v4 LTS moves to 4.26.x), the allowedVersions range must be updated manually alongside the version bump.