Fixed Renovate security update matching (#28229)

## Summary
- match real vulnerability alerts instead of setting
isVulnerabilityAlert on all non-major updates
- keep the 72h minimum release age explicit for vulnerability alerts too

## Testing
- parsed renovate.json5
- git diff --check