chore: set up Renovate for dependency updates [MEC-3447]

[contentful-renovate-rollout]

Sets up Renovate as the dependency-update tool for this repository, part of an org-wide rollout.

Depending on this repo's starting state, this PR does some of the following:

• adds a repo-local renovate.json extending the Contentful shared preset
• for repos that used Dependabot: ports repo-specific behavior (PR limits, ignores, grouping) into local packageRules where still needed, and removes Dependabot-only automation and secret policies
• updates docs that referenced Dependabot

Manual follow-up (not handled by this PR):

• close stale Dependabot PRs and branches once Renovate is active (for repos that used Dependabot)

Migration Confidence: 🟡 Medium

Summary

Migrated from Dependabot to Renovate: deleted .github/dependabot.yml and the dependabot-approve-and-request-merge.yml workflow, removed the dependabot vault secret policy from .contentful/vault-secrets.yaml, updated the CODEOWNERS comment wording, and added renovate.json extending local>contentful/renovate-config:defaultNxMonorepo (correct for this Nx monorepo). However, the renovate.json includes extra packageRules (disabling npm major updates, disabling @contentful/app-sdk, grouping prod/dev deps) that were partially translated from the old Dependabot config — but incompletely (the prettier, serverless >=3, and emotion >=11 ignores were not ported). The standard migration would only add the extends line and rely on the shared preset for all policy.

Files requiring attention

The following files had edge cases or required judgment during migration and should be reviewed carefully:

• .contentful/renovate.json
• renovate.json