Play Framework

chore: retire dependabot, consolidate dependency tracking under Renovate

Dependabot's only configured ecosystem was github-actions; it didn't
cover the npm package.json in resources/nuxt-skel/ or the Java deps
in framework/dependencies.yml (Dependabot has no parser for the Play 1
Ivy-YAML format). Renovate now handles all three surfaces under a
single dashboard issue.

Changes
- .github/dependabot.yml — removed.
- renovate.json5 — removed the explicit "github-actions: enabled=false"
  stanza so Renovate picks up workflows automatically. Header comment
  updated to reflect single-bot ownership. Added a packageRule that
  pins third-party Actions to a commit digest (mitigates the "owner
  retags a release tag with malicious code" supply-chain pattern;
  Renovate updates the digest and keeps a human-readable version
  comment alongside).

No code change. Renovate's GitHub App needs to remain installed on
tsukhani/play1; on its next scheduled run it'll pick up the new
manager scope and open the dependency dashboard issue.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>