ci: reduce renovate watchlist

[Zaimwa9]

Summary

• Migrates from Dependabot to Renovate, matching the flagsmith-common commit style (deps: prefix, :semanticCommitScopeDisabled).
• First packageRule disables all routine updates by listing every matchUpdateTypes except vulnerabilityAlerts — CVE PRs still flow through for all dependencies.
• Second packageRule re-enables git-submodules and all pip managers (pip_requirements, pip-compile, pep621, poetry), matching the existing Dependabot behavior of bumping pip dependencies.
• github-actions manager stays disabled — Dependabot wasn't managing those either.
• git-submodules enabled at top level so Renovate tracks engine-test-data tag updates.

Test plan

• Renovate dashboard issue shows pip dependencies and engine-test-data submodule as detected, but no github-actions PRs.
• Confirm Dependabot security updates remain enabled at the repo level so the CVE path stays redundant-by-design.

[github-actions]

File	Coverage		Missing
All files	100%	✅

Minimum allowed coverage is 100%

Generated by 🐒 cobertura-action against c4456cb

[codspeed-hq]

Merging this PR will not alter performance

✅ 1 untouched benchmark

---

_{Comparing ci/reduce-renovate-watchlist (c4456cb) with main (05bd5dc)}

[khvn26]

One question before I approve.