add initial config for renovate

[escattone]

Proposed initial config for renovate. renovate is not yet enabled for this repo, but I'd like to enable it once #1249 lands in order to pin the digests in the Dockerfile. This config also exposes package.json to renovate, but we might not want to do that yet.

[peterbe]

Hmm... Are we ready for the onslaught of Renovate PRs to update dependencies in package.json? With Kuma we did:

"ignorePaths": [
    "package.json",

Also, Kumascript uses the old legacy npm-shrinkwrap.json solution which I don't even know if Renovate supports.

As I vaguely understood it, npm-shrinkwrap.json was the old way and package-lock.json is the hit new thing.

[escattone]

@peterbe Good points! I don't think we're ready yet for the onslaught of Renovate PRs to update dependencies in package.json, and like you said, we'd probably have to upgrade to using package-lock.json anyway, so I'll add the "ignorePaths": ["package.json"] here, and we'll just focus on pinning the digest in the Dockerfile.

[peterbe]

If it doesn't work, we can tune it later.