Enforce 72h minimum release age for all Renovate updates (#28201)

no ref
- Moves `minimumReleaseAge: \"3 days\"` to the top level of
`.github/renovate.json5` so the 72-hour soak applies to every dependency
update, not only those triggered by vulnerability alerts.
- Removes the now-redundant per-block `minimumReleaseAge` on
`vulnerabilityAlerts` (it inherits the top-level setting) and refreshes
the surrounding comment.

## Why
The global 72h release-age soak was lost in the self-hosted Renovate
migration; it currently only protects CVE-driven updates. The same soak
should cover routine updates too, since compromised publishes and hotfix
churn aren't unique to security advisories.