Use renovate to update GitHub Actions across library repositories

[bdice]

In https://github.com/rapidsai/cuml/actions/runs/29758165429/job/88405843597?pr=8396, we saw that GitHub Actions are outdated in cuML.

Show logs

 INFO zizmor: 🌈 zizmor v1.24.1
 INFO audit: zizmor: 🌈 completed .github/workflows/build.yaml
 INFO audit: zizmor: 🌈 completed .github/workflows/labeler.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/new-issues-to-triage-projects.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/pr.yaml
 INFO audit: zizmor: 🌈 completed .github/workflows/pr_assign_author.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/pr_issue_status_automation.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/test.yaml
 INFO audit: zizmor: 🌈 completed .github/workflows/trigger-breaking-change-alert.yaml
warning[ref-version-mismatch]: action's hash pin has mismatched or missing version comment
  --> .github/workflows/pr_issue_status_automation.yml:63:77
   |
63 |           uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
   |           ---------------------------------------------------------------   ^^ points to commit 11d5960a3267
   |           |
   |           is pointed to by tag v4.3.1
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#ref-version-mismatch

warning[ref-version-mismatch]: action's hash pin has mismatched or missing version comment
   --> .github/workflows/pr_issue_status_automation.yml:118:77
    |
118 |           uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
    |           ---------------------------------------------------------------   ^^ points to commit 11d5960a3267
    |           |
    |           is pointed to by tag v4.3.1
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#ref-version-mismatch

116 findings (48 ignored, 66 suppressed, 2 fixable): 0 informational, 0 low, 2 medium, 0 high

This is likely a problem across all library repositories.

We should enable renovate everywhere, with groupings (to reduce the number of PRs) and cooldowns (to ensure that we adopt versions after they have had time to settle).

This is specifically proposing the updates for GitHub Actions. #276 also suggests using this to update pre-commit hooks, though we have some nuances there (like not updating clang-format without synchronization across projects).

Approach

Task List

N/A

[jameslamb]

I'll pick this up this week, agree we should do it and pair it with #278