chore: Add Renovate config and pin GitHub Action versions to full semver

[jsonbailey]

Summary

• Adds .github/renovate.json to enable Renovate with pinGitHubActionDigests (matching the pattern used in js-core and learn-release-please)
• Pins all @v4 GitHub Action references to their latest full semver patch versions so Renovate can track them with SHA pinning and version comments:
  • actions/checkout@v4 → v4.3.1
  • actions/upload-artifact@v4 → v4.6.2
  • actions/attest@v4 → v4.1.0
• googleapis/release-please-action was already SHA-pinned with a version comment — no change needed

Once the terraform PR (adding this repo to the Renovate app installation) merges and applies, Renovate will open a PR replacing these full semver tags with SHA digests plus version comments.

Test plan

• Confirm renovate.json is valid JSON and matches the expected shape
• Confirm no bare @v4 (without patch version) references remain in workflow files
• After terraform PR merges, verify Renovate opens a PR converting the semver pins to SHA digests

🤖 Generated with Claude Code

---

Note

Low Risk
Only CI configuration and third-party action version pins change; no application runtime, auth, or data-path code is touched.

Overview
Introduces Renovate via .github/renovate.json (recommended preset, pinGitHubActionDigests, and OSV/vulnerability alerts) so dependency and GitHub Action updates can be automated like other LaunchDarkly repos.

Across CI, build, publish, and release workflows, floating @v4 tags for actions/checkout, actions/upload-artifact, and actions/attest are replaced with explicit patch versions (v4.3.1, v4.6.2, v4.1.0) as a stepping stone before Renovate can pin them to commit SHAs with version comments.

^{Reviewed by Cursor Bugbot for commit e4f8125. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 143f31b. Configure here.}

[jsonbailey]

I am adding the full semver in the hopes that when renovate runs and converts these to a SHA, it will include the full semver in the comment.