chore: Extend the shared dependency update policy

Renovate opens pull requests here on its own schedule, and one sit open
now. This repository has no CODEOWNERS, so nobody is asked to review
them and they accumulate without anyone noticing.

This replaces the stock recommendation with a reference to the
organization's shared policy. Updates are listed on this repository's
dependency dashboard and open only when someone asks for one, and
security fixes stay exempt and open on their own.

What survives here is digest pinning, the lock file range strategy, and a custom manager tracking the Bun version in workflow files.

An audit of every repository carrying its own config found the label
rules and the security priority rule in this file repeated across five
repositories. They now live in the shared preset. The priority rule
matched nothing in any of them, because Renovate's categories are the
fixed manager set and security is not one, so it is dropped rather
than carried forward.

Related to datum-cloud/infra#4926

Claude-Session: https://claude.ai/code/session_0196U66w5xh9yRsAosKcA3if

Author: ecv

renovate.json

@@ -1,11 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended", "helpers:pinGitHubActionDigests", "docker:pinDigests"],
-  "vulnerabilityAlerts": {
-    "enabled": true,
-    "labels": ["security", "renovate"]
-  },
-  "osvVulnerabilityAlerts": true,
+  "extends": ["local>datum-cloud/.github:renovate-config", "helpers:pinGitHubActionDigests", "docker:pinDigests"],
   "rangeStrategy": "update-lockfile",
   "customManagers": [
     {
@@ -15,15 +10,5 @@
         "bun-version:\\s*(?<currentValue>\\S+)\\s*}\\s*#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)"
       ]
     }
-  ],
-  "packageRules": [
-    {
-      "labels": ["renovate"],
-      "matchPackageNames": ["/.*/"]
-    },
-    {
-      "matchCategories": ["security"],
-      "prPriority": 10
-    }
   ]
 }