chore: group Go toolchain version updates into a single PR

[olegsu]

Summary

• Add a custom Renovate manager to detect the .go-version file (no built-in manager picks it up)
• Override go.mod's go directive versioning from go-mod-directive to semver so Renovate proposes minor version bumps
• Group all Go toolchain updates (bin/hermit, .go-version, go.mod) into a single PR via groupName: "go-version"

Previously, Renovate only updated the hermit-managed Go binary in bin/, leaving .go-version and go.mod out of sync.

Test plan

• Verified locally with renovate --platform=local dry-run: all 4 Go version updates (go.mod, scripts/update_assets_md/go.mod, bin/hermit, .go-version) resolve to the same renovate/go-version branch

Made with Cursor

[mergify]

This pull request does not have a backport label. Could you fix it @olegsu? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v./d./d./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.