Improve Renovate dependency management configuration

[harryswift01]

Summary

This PR tidies up how Renovate manages our dependency and GitHub Actions updates, so PRs are safer, better organised, and land at sensible times.

Changes

• GitHub Actions updates are now pinned to a specific commit for security
• Updates to the packages we ship are handled more gently, so we don't force stricter version requirements on people using CodeEntropy
• Our own dev/testing tools still get updated normally
• Update PRs are now grouped and labelled by type (Actions, production deps, dev tools) instead of all looking the same
• New package releases wait 3 days before we get a PR for them, avoiding freshly-released bugs

Impact

• Easier to review and prioritise dependency PRs
• Less chance of pulling in a broken or unstable release
• Less risk of tightening requirements in a way that causes problems for people installing CodeEntropy

[jimboid]

Thanks for bringing this in. It will bring much greater control over dependency updates. We know this works on several other project repos now. The only note remaining is that in the future we should move the deps in pyproject.toml to ranges and not single versions or unguarded so that the widen strategy does it's job, but this is for later.