feat(renovate): add OSV security alerts and pin the automerge strategy

Enable osvVulnerabilityAlerts (Gitea has no advisory feed of its own) with the
OSV summary on the dependency dashboard, and let security fixes skip the 3-day
minimumReleaseAge in their own labelled PR. Set automergeStrategy to squash so
automerged dependency updates match the repository history.

renovate.json

@@ -8,6 +8,10 @@
 	],
 	"labels": ["dependencies"],
 	"dependencyDashboard": true,
+	"dependencyDashboardOSVVulnerabilitySummary": "all",
+	"osvVulnerabilityAlerts": true,
+	"configMigration": true,
+	"automergeStrategy": "squash",
 	"prConcurrentLimit": 5,
 	"prHourlyLimit": 3,
 	"minimumReleaseAge": "3 days",
@@ -28,6 +32,13 @@
 			"labels": ["major"],
 			"dependencyDashboardApproval": true
 		},
+		{
+			"description": "Beveiligingsfixes (OSV) niet tegenhouden door de wachttijd en in een eigen PR",
+			"matchCategories": ["security"],
+			"minimumReleaseAge": null,
+			"groupName": "security fixes",
+			"addLabels": ["security"]
+		},
 		{
 			"description": "Docker-compose draait op :latest; geen digest-pin-ruis",
 			"matchManagers": ["docker-compose"],