improve renovate: osv alerts, pin cli, slower cron

Prioritize vulnerability fix PRs, pin Renovate via package-lock for
reproducible runs, and drop the hourly schedule to every 6 hours.

renovate.json

@@ -3,7 +3,8 @@
     "config:recommended",
     ":configMigration",
     "group:allNonMajor",
-    ":disableDependencyDashboard"
+    ":disableDependencyDashboard",
+    "abandonments:recommended"
   ],
   "gitAuthor": "Renovate Bot <renovate@keligrubb.com>",
   "semanticCommits": "enabled",
@@ -12,6 +13,15 @@
   "prBodyTemplate": "{{{header}}}{{{table}}}{{{warnings}}}{{{notes}}}{{{changelogs}}}{{{controls}}}",
   "minimumReleaseAge": "3 days",
   "rangeStrategy": "auto",
+  "labels": ["dependencies"],
+  "osvVulnerabilityAlerts": true,
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "labels": ["security", "dependencies"],
+    "minimumReleaseAge": "0 days"
+  },
+  "prConcurrentLimit": 5,
+  "prHourlyLimit": 5,
   "dockerfile": {
     "digest": { "enabled": false }
   },