Update renovate configs to enable updates for CVE on release branches

[luolanzone]

Note

Low Risk
Configuration-only changes to Renovate automation with no impact on runtime code or security posture.

Overview
Enables security vulnerability updates for active release branches (release-2.5, release-2.4, release-2.3) and indirect Go dependencies that were previously disabled.

Adds two new packageRules in renovate.json5 with isVulnerabilityAlert: true to re-enable CVE updates for release branches and indirect Go modules. Updates the hack/update-renovate-baseBranches.sh script to replace all occurrences of matchBaseBranches (instead of just the first) when updating release branch versions, ensuring the new security rules stay synchronized with the active release branches.

^{Written by Cursor Bugbot for commit e06218a. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

[cursor]

Package-specific disable rule overrides vulnerability re-enable

High Severity

The package-specific disable rule for k8s.io/, sigs.k8s.io/, and other packages appears after the vulnerability re-enable rules (lines 41-45, 55-60). Since Renovate applies rules in order with later rules overriding earlier ones, this rule will disable vulnerability updates for these packages on release branches, contradicting the PR's intent to enable CVE updates on release branches. The rule should either be moved before the vulnerability re-enable rules or explicitly exclude vulnerability alerts.