Add Renovate config

Same policy as adguard-cidre: patch-level Dockerfile bumps automerge,
minor/major get a labeled PR, vulnerability alerts labeled bug. No
pip_requirements rule — this repo has no Python dependencies to manage.

Still needed on the Gitea/Renovate side (manual, not done here):
uncomment socat-proxy in the shared ~/renovate/config.js repositories
array on stockeex, and create the bot/major/minor/bug labels in this
repo's Issues → Labels (Renovate silently drops labels that don't
already exist).

renovate.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "timezone": "Europe/Paris",
+  "labels": ["bot"],
+  "packageRules": [
+    {
+      "matchManagers": ["dockerfile"],
+      "matchUpdateTypes": ["patch"],
+      "automerge": true
+    },
+    {
+      "matchUpdateTypes": ["major"],
+      "addLabels": ["major"]
+    },
+    {
+      "matchUpdateTypes": ["minor"],
+      "addLabels": ["minor"]
+    }
+  ],
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "addLabels": ["bug"]
+  }
+}