feat(renovate): track tagless git commit pins via git-refs digest mode

[cplieger]

Some upstreams publish no tags and no versioned artifact, so a commit is the only identifier they offer. Nothing in the preset could track that shape, so such a pin silently never moves.

x264 is the case in hand, verified rather than assumed:

• git ls-remote --tags https://code.videolan.org/videolan/x264.git returns zero tags. Only three branches exist (master, stable, GPLv2-only).
• VideoLAN's versioned snapshot tarballs still serve HTTP 200 but the newest file is x264-snapshot-20191217-2245-stable.tar.bz2, abandoned since December 2019.
• subflux's ARG X264_COMMIT consequently sat at a May 2024 commit, 26 months old and 31 commits behind stable.

This adds a Dockerfile customManager for a branch= marker, using the git-refs datasource's documented digest mode: the named ref goes in currentValue and the commit is matched as currentDigest, so Renovate resolves the branch head itself and rewrites the ARG. No postUpgradeTasks needed — Renovate supplies the new commit directly.

Marker shape:

# renovate: datasource=git-refs depName=videolan/x264 packageName=https://code.videolan.org/videolan/x264.git branch=stable
ARG X264_COMMIT=b35605ace3ddf7c1a5d67a2eb553f034aef41d55

Mutual exclusion with the two neighbouring commit-pin conventions, tested against every Dockerfile in the fleet:

• The generic ARG manager requires ARG on the line immediately after depName, so the packageName= token locks it out.
• The digest=commit manager needs datasource=github-tags plus its own marker token, and resolves a tag to its commit — which a tagless repo cannot offer.
• Out of repin-sha.sh's postUpgradeTasks scope as well: that recomputes the sha256 of an artifact a version names, and here there is neither a version nor a sha256 pin.

A full 40-char sha is required by the regex so Renovate's first digest comparison is exact; a short sha can never compare equal to a resolved full one and would produce a no-op lengthening PR.

Validated with renovate-config-validator (exit 0). No-op in any repo without a branch= marker; the only current consumer is subflux (cplieger/subflux PR pairs with this).

One thing worth a decision: digest is in this file's automerge allowlist, so once tracked, x264 commits will auto-merge. I left that at the default rather than inventing a gate. If a branch head should get a human glance first, the git-cliff and tool-registry digest alarms in this file are the pattern to copy.