improve renovate: osv vulnerability alerts, abandonment reporting, pr limits (#8)

## Summary
* turn on `osvVulnerabilityAlerts` + `vulnerabilityAlerts` so vulnerable deps get their own PRs labeled `security`, instead of just riding along in the grouped non-major PR
* vuln PRs still respect the 3 day `minimumReleaseAge` cooldown on purpose. bypassing it would let a compromised release (shai-hulud style) land the moment it publishes, which is worse than sitting on a known cve for 3 days
* add `abandonments:recommended` so unmaintained packages get flagged early
* add `dependencies` label plus `prConcurrentLimit` / `prHourlyLimit` of 5 so a first run on a stale repo doesn't dump 30 prs
* no workflow behavior changes. schedule stays hourly, install stays as-is. just fixed the readme, which said every 6 hours while the cron was hourly

needs `dependencies` and `security` labels to exist on the repos (or org-wide), otherwise labeling just no-ops.

---------

Co-authored-by: Madison Grubb <madison@elastiflow.com>
Reviewed-on: #8

renovate.json

@@ -3,7 +3,8 @@
     "config:recommended",
     ":configMigration",
     "group:allNonMajor",
-    ":disableDependencyDashboard"
+    ":disableDependencyDashboard",
+    "abandonments:recommended"
   ],
   "gitAuthor": "Renovate Bot <renovate@keligrubb.com>",
   "semanticCommits": "enabled",
@@ -12,6 +13,14 @@
   "prBodyTemplate": "{{{header}}}{{{table}}}{{{warnings}}}{{{notes}}}{{{changelogs}}}{{{controls}}}",
   "minimumReleaseAge": "3 days",
   "rangeStrategy": "auto",
+  "labels": ["dependencies"],
+  "osvVulnerabilityAlerts": true,
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "labels": ["security", "dependencies"]
+  },
+  "prConcurrentLimit": 5,
+  "prHourlyLimit": 5,
   "dockerfile": {
     "digest": { "enabled": false }
   },