ci: add renovate config

[sydorovdmytro]

Closes DEVOPS-969

Summary

• Onboard Renovate for this public Go API/library, covering go.mod, GitHub Actions, and the pinned code-generator tools in the Justfile.
• Conservative policy: Go patch updates grouped, the k8s.io/sigs.k8s.io ecosystem grouped so it moves in lockstep; majors and minors stay individual PRs for review.
• Add the validate-renovate CI caller workflow so config edits are validated on every PR.

Coverage

Dependency surface	Manager
go.mod requires (26 deps incl. go directive, k8s.io/*, sigs.k8s.io/*, stripe-go, x/*, protobuf)	built-in gomod (+ gomodTidy)
.github/workflows/*.yaml uses: actions (checkout, setup-go, golangci-lint-action) + the new validate-renovate pin	built-in github-actions (digests pinned via helpers:pinGitHubActionDigests)
go-version: "1.22" in go.yml setup-go step	built-in github-actions (native go-version detection)
go run k8s.io/code-generator/cmd/deepcopy-gen@v0.28.1 in Justfile	custom regex manager (datasource go)
go run k8s.io/kube-openapi/cmd/openapi-gen@v0.0.0-... in Justfile	custom regex manager (datasource go)

The two Justfile tool pins use depNames k8s.io/code-generator and k8s.io/kube-openapi, so they group under k8s-go-deps alongside the matching go.mod entries.

Deliberately not managed

• go run github.com/dkorunic/betteralign/cmd/betteralign@latest (Justfile) — pinned to @latest, not a fixed version, so there is nothing for Renovate to bump. Left as-is.
• No replace directives, no vendor/, no Dockerfiles, no Terraform, no Helm charts, no .tool-versions, no proto/buf toolchain, no dependabot.yml — none exist in this repo, so no managers or removals were needed.

Test plan

• renovate-config-validator renovate.json — passed ("Config validated successfully").
• Custom regex managers verified with python3's re module against the real files — each matchString matches exactly once:
  • deepcopy-gen pattern -> 1 match (v0.28.1)
  • openapi-gen pattern -> 1 match (v0.0.0-20260127142750-a19766b6e2d4)
• LOG_LEVEL=debug renovate --platform=local --dry-run=extract — 7 package files found across managers: github-actions (4 workflow files, incl. go-version + validate-renovate digest), gomod (go.mod, 26 deps), regex (2 Justfile tool pins). Every ecosystem from the inventory is covered.
• actionlint on the new workflow — 0 findings.
• zizmor on the new workflow — 0 findings (reusable workflow pinned to SHA b52efbd927586ea78282073f79d2423e552c9f62 for validate-renovate/v1).

Post-merge checklist

• Dependency Dashboard issue appears and the first run resolves all managers (gomod, github-actions, 2x regex).
• Existing GitHub security alerts start getting security-labeled PRs (bypass the weekly schedule).