chore(deps): Update security configurations of Renovate

[deiga]

Summary

Update the Renovate setup and make dependency updates more conservative across npm and Python.

What changed

• Migrate the Renovate config from JSON to JSON5 so the config can be documented inline and extended more cleanly.
• Enable Renovate config migration PRs.
• Enable abandoned dependency detection.
• Require a minimum release age of 3 days before accepting updates for npm and Python dependencies.
• Delay version update branch/PR creation until the minimum release age checks have passed.
• Enable weekly lockfile maintenance.
• Some uv dependencies we're downgraded since they were newer than 3d old

Additional config changes

• Add npm min release age configuration for the frontend.
• Add uv exclude-newer configuration for Python dependencies.

Why

These changes should reduce churn from very fresh releases and improve supply chain security, and surface stale dependencies earlier