Dependency Management Automation

_Note: this issue is a port of https://github.com/NerdWalletOSS/shepherd/issues/111_

## Narrative

As a maintainer of Handlebars, I want a quick and easy way to keep dependencies up-to-date and reduce the level-of-effort associated with the corresponding releases.

## Proposed Change

The proposed change is to integrate renovate, renovate approve, semantic commits, and semantic-releases.

With the right combination of settings across these four Github apps, CI/CD can take care of updating minor and patch dependencies (relative to the semantic commit message), approving and merging of the corresponding PRs, publishing a new tag version, and finally updating release notes (if needed) and changelog.

## Technical Details
- Use github workflows
- Add `GH_TOKEN` secret with properly provisioned token (repo access is sufficient)
- Need to decide on a set of types that will trigger releases and the corresponding semver bump. For example, we can have:
- `docs`, `style`, `refactor`, and `perf` map to patch semver bump
- `feat` map to patch semver bump
- conventional commits should use the following scopes:
- parser, compiler, runtime, cli
- Update documentation in CONTRIBUTING.md

## ROI
- near _real time_ vulnerability and security patches
- reduced overhead for maintainers
- reduced CI/CD failures for consumers (at least for those that run `npm audit` as part of their CI)

## DependaBot vs RenovateBot

| | DependaBot | RenovateBot |
|----|----|----|
|post install config (i.e. run `npm dedupe`) | No | Yes |
|price | Free | Free |

## Nice to have
- WIP app

## Notes
- Dependabot (see https://dependabot.com)
- Renovate Approve (see https://github.com/apps/renovate-approve)
- Renovate (see https://github.com/marketplace/renovate)
- Semantic Release (see https://github.com/semantic-release/github)
- Semantic Pull Requests (see https://github.com/zeke/semantic-pull-requests)

Start by reviewing the proposed GitHub workflows, the required GH_TOKEN secret setup, and the existing CONTRIBUTING.md guidance. Define the release-triggering commit types and scopes, then verify that dependency updates, approvals, merges, tags, release notes, and changelog updates follow the agreed workflow.

Written by the indexing model from the issue text.