improve renovate: osv alerts, pin cli, slower cron

Prioritize vulnerability fix PRs, pin Renovate via package-lock for
reproducible runs, and drop the hourly schedule to every 6 hours.

package.json

@@ -0,0 +1,8 @@
+{
+  "name": "renovate-runner",
+  "private": true,
+  "description": "Runs Renovate against git.keligrubb.com via Gitea Actions",
+  "dependencies": {
+    "renovate": "44.28.0"
+  }
+}