Re-enable `osvVulnerabilityAlerts` once Renovate pvp parses OSV fixed-version constraints

## Summary

Restore OSV advisory coverage for cabal dependencies by setting
`osvVulnerabilityAlerts: true` in `renovate.json`, once Renovate can
parse the constraint it generates for Haskell packages.

## Motivation

`osvVulnerabilityAlerts` is `false`, against the house default of `true`.
That is a real loss rather than a preference: Dependabot has no Haskell
coverage, so every cabal dependency currently has no advisory signal at
all.

It was disabled in #181 to stop repository runs aborting (#180), and the
divergence was reaffirmed in #184. The cause is upstream and unfixed as
of 2026-07-26:

- `getFixedVersionConstraint` in `lib/util/vulnerability/utils.ts`
returns `>= ` for every ecosystem outside `{maven, nuget}`.
- pvp's `parseRange` (`lib/modules/versioning/pvp/range.ts`) matches only
`>=x && =x` — both bounds required — so a bare
`>= 2.3.1.0` returns null.

The bad rule is generated at lookup time, so no `packageRules` entry can
suppress it. It is all-or-nothing until upstream changes.

## Scope

- Watch for an upstream fix on either side: pvp accepting a lower-bound-only
range, or `getFixedVersionConstraint` emitting a two-bound range for
hackage.
- Set `osvVulnerabilityAlerts: true` in `renovate.json`.
- Confirm a repository run completes without a config-validation abort.

## Acceptance criteria

- [ ] `osvVulnerabilityAlerts` is `true` in `renovate.json`
- [ ] A Renovate run completes with no Repository Problems on Dependency
Dashboard #71
- [ ] No "Action Required: Fix Renovate Configuration" issue is filed by
the run

## Additional context

Blocked on upstream Renovate, so there is no in-repo `blocked-by` edge to
add. Related: #180 (the abort), #181 (disabled it), #184 (reaffirmed the
divergence), #194 (audited it and left it disabled).

Start by checking the upstream Renovate and pvp status described in the issue, including getFixedVersionConstraint in lib/util/vulnerability/utils.ts and parseRange in lib/modules/versioning/pvp/range.ts. Once the fixed-version constraint is supported, update osvVulnerabilityAlerts in renovate.json and run the repository checks. Done means a Renovate run completes without Repository Problems or a configuration-action issue.

索引モデルが issue の本文から書いたものです。