Add renovate support for updating lockfile

@mark-thm I know you mentioned some ideas for tooling to manage the lockfile. @cgrindel contributed the Bazel module to renovate so it can send bot PRs against the MODULE.bazel file - maybe a similar approach could work here?

I think the hard part is that each tool has different conventions. Even for those that use GitHub releases to serve artifacts, there are variations on filenames, and some publish checksums while others do not.