deps: update renovate configuration

[erhancagirici]

Description of your changes

Extends the renovate configuration with custom managers and some noise tweaking

Static validation with renovate-config-validator --strict and tested with the local mode.

Global settings

• prConcurrentLimit: 5 — cap parallel Renovate PRs.
• baseBranchPatterns: ["main"] — only target main.
• labels: ["automated", "renovate"] — all PRs are labeled.
• Enabled vulnerabilityAlerts and osvVulnerabilityAlerts explicitly, so the rules that
  are deliberately disabled below still produce PRs for known CVEs.
• Renamed the Crossplane manager's fileMatch to managerFilePatterns and
  switched to the regex-delimiter syntax, per the newer Renovate schema.

New custom regex managers

Bump versions that are embedded in CI files rather than a lockfile:

Manager	Files	Variables
Go	.github/workflows/*.yaml, Dockerfile	GO_VERSION, ARG GO_VERSION
golangci-lint	.github/workflows/*.yaml	GOLANGCI_VERSION, GOLANGCILINT_VERSION
Docker Buildx	.github/workflows/*.yaml	DOCKER_BUILDX_VERSION
Crossplane CLI	.github/workflows/*.yaml	XP_VERSION (assumes the stable channel)

New package rules

Kubernetes Go dependencies

• Pin k8s.io/client-go to <1.0, since old pre-semver tags are still
  published in the repo.
• Group all patch/digest bumps of k8s.io/** and sigs.k8s.io/** into a
  single "kubernetes patches" PR.
• major/minor bumps require dependency dashboard approval — these should
  typically follow crossplane-runtime for maximum compatibility.
• Explicitly disable digest updates for k8s.io/utils and
  k8s.io/kube-openapi; they have no version tags and are best managed
  transitively by the other k8s dependencies.

Crossplane Go dependencies (github.com/crossplane/**)

• Separate PRs per major/minor/patch (separateMajorMinor,
  separateMinorPatch, separateMultipleMinor).
• patch bumps flow automatically.
• major/minor/digest bumps require dependency dashboard approval, since
  they may involve actual development work.

Other Go dependencies

• Disabled for both major and minor/patch/digest. Combined with the
  vulnerability alert settings above, these only get PRs when there is a known
  vulnerability in the current version.

GitHub Actions

• minor/patch grouped into a single "all non-major github action" PR.
• major bumps get dedicated PRs.
• Both use minimumReleaseAge: 3 days and pinDigests: true.

Grouping for CI tooling

• crossplane/crossplane + crossplane/cli → one "crossplane versions in CI" PR.
• golangci/golangci-lint → its own "golangci-lint versions in CI" PR.
• The Go directive in go.mod (rangeStrategy: bump) is grouped with the CI env
  vars into a single "golang versions" PR, with separateMinorPatch enabled.

I have:

• Read and followed Crossplane's contribution process.
• Added or updated unit tests for my change. (configuration-only change)