chore: add Renovate config for Actions and Go deps (#26)

Automerge Actions and low-risk test modules; require dashboard
approval for jwx majors; leave the go directive alone.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: yaronf

renovate.json

@@ -0,0 +1,47 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":dependencyDashboard"
+  ],
+  "labels": ["dependencies"],
+  "prConcurrentLimit": 3,
+  "prHourlyLimit": 2,
+  "postUpdateOptions": ["gomodTidy"],
+  "packageRules": [
+    {
+      "description": "Group and automerge GitHub Actions (minor/patch/digest)",
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["minor", "patch", "digest"],
+      "groupName": "github-actions",
+      "automerge": true,
+      "automergeType": "pr",
+      "platformAutomerge": true
+    },
+    {
+      "description": "Automerge low-risk Go test deps (minor/patch)",
+      "matchManagers": ["gomod"],
+      "matchPackageNames": [
+        "github.com/stretchr/testify",
+        "github.com/sergi/go-diff"
+      ],
+      "matchUpdateTypes": ["minor", "patch"],
+      "automerge": true,
+      "automergeType": "pr",
+      "platformAutomerge": true
+    },
+    {
+      "description": "jwx majors require dashboard approval (API/crypto risk)",
+      "matchManagers": ["gomod"],
+      "matchPackagePatterns": ["^github\\.com/lestrrat-go/jwx"],
+      "matchUpdateTypes": ["major"],
+      "dependencyDashboardApproval": true
+    },
+    {
+      "description": "Do not bump the go directive automatically",
+      "matchManagers": ["gomod"],
+      "matchDepNames": ["go"],
+      "enabled": false
+    }
+  ]
+}