Play Framework

chore: add renovate.json5 for dependency tracking

Coordinates with the existing dependabot.yml (which owns GitHub
Actions updates) by explicitly disabling the github-actions manager
in Renovate. Renovate covers the rest:

- npm deps in resources/nuxt-skel/package.json (Nuxt frontend
  skeleton). Auto-merge non-major bumps — tests gate /deploy so
  regressions are caught before release.
- Java deps in framework/dependencies.yml via a custom regex manager.
  Pattern matches the "groupId -> artifactId version" lines that make
  up the bulk of the manifest (112 matches across the current file).
  Legacy Ivy short-form deps without a "->" (antlr4-runtime,
  commons-*, jaxen, jregex) aren't captured — they use group=artifact
  conventions that don't map cleanly to Maven Central group IDs;
  manual tracking remains for those.

Java-dep PR workflow is partial: Renovate edits the YAML but cannot
run `ant resolve` to download the new jar and prune the old one in
framework/lib/. The user finishes a Java-dep PR locally:

    gh pr checkout <number>
    cd framework
    ant resolve -Dprune=true
    git add framework/lib framework/dependencies.yml
    git commit -m "ant resolve"
    git push

Then merges as usual. Header comments in renovate.json5 document this
flow so future contributors aren't surprised.

Multi-artifact families (Netty, Micrometer, Swagger, Jackson,
Hibernate, Log4j, Prometheus, JUnit, Bouncy Castle, Jakarta APIs,
Eclipse JDT, brotli4j, Groovy) are grouped so one PR bumps the whole
family in lockstep — saves merge churn and avoids version-skew
between codependent artifacts.

Schedule: off-hours weekday + weekends only, in Asia/Singapore TZ.
PR concurrency capped at 5, hourly limit 2.

Verified by parsing the JSON5 with the json5 lib and running the
regex against the current dependencies.yml — 112 deps captured with
correct group:artifact:version triples.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>