chore: enable Renovate platformAutomerge with safety guards

[acockrell]

Summary

• Add platformAutomerge: true to all automerge rules so Renovate uses GitHub's native auto-merge API (previously automerge was configured but never firing)
• Add minimumReleaseAge: "3 days" globally — supply chain safety net that prevents merging packages published less than 3 days ago
• Extend Go dependencies rule with automerge: true (was grouping-only, blocking minor/patch/digest updates like PR fix(deps): update module google.golang.org/api to v0.279.0 #72)
• Collapse GitHub Actions into one rule covering minor, patch, and digest (SHA rotation updates like PR chore(deps): update github/codeql-action digest to 9e0d7b8 #71 now covered)

GitHub settings (applied separately, outside this PR)

• Repo-level allow_auto_merge enabled via gh api — required for GitHub native auto-merge API
• Branch protection on main with required status check All Checks Passed — needs to be applied manually (see below)

To apply branch protection, run:

gh api repos/ACLabs-Code/google-admin-client/branches/main/protection \
  --method PUT \
  --input - <<'PROTECTION'
{
  "required_status_checks": {
    "strict": false,
    "checks": [{ "context": "All Checks Passed" }]
  },
  "enforce_admins": false,
  "required_pull_request_reviews": null,
  "restrictions": null,
  "allow_force_pushes": false,
  "allow_deletions": false
}
PROTECTION

Test plan

• Apply branch protection command above
• Merge this PR
• Check the rebase checkbox on PRs chore(deps): update github/codeql-action digest to 9e0d7b8 #71 and fix(deps): update module google.golang.org/api to v0.279.0 #72 — they should automerge once CI passes
• Verify: gh api repos/ACLabs-Code/google-admin-client --jq .allow_auto_merge returns true
• Verify: gh api repos/ACLabs-Code/google-admin-client/branches/main/protection --jq .required_status_checks