chore: adopt Renovate for dependency updates

[prabinoid]

What type of PR is this? (check all applicable)

• 🍕 Feature
• 🐛 Bug Fix
• 📝 Documentation
• 🧑‍💻 Refactor
• ✅ Test
• 🤖 Build or CI
• ❓ Other (please specify)

Related Issue

Fixes #7183

Describe this PR

Adds renovate.json to automate dependency updates with Renovate, per
docs 0012
(reduce GitHub vendor lock-in). Supersedes the Dependabot config in #7274.

• Four ecosystems only: pep621, npm, dockerfile, docker-compose
  (GitHub Actions intentionally excluded)
• Weekly batch (Mon, UTC), minor/patch grouped into consolidated PRs
• Direct deps only; legacy requirements.txt skipped
• No auto-merge; major updates held behind Dependency Dashboard approval
• ignoreDeps for critical pins: postgis/postgis, python, node, and
  TM's own ghcr.io/hotosm/tasking-manager/* images

renovate.json validates against the Renovate schema. It does nothing until
the Renovate app has access to this repo.

I think Renovate is already installed on the org (it's active on
field-tm), so this probably just needs tasking-manager added to the app's
repo access rather than a fresh install.

Alternative Approaches Considered

Dependabot (#7274) — dropped in favour of Renovate per ADR 0012; this ports
that config's intent.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud