chore(ci): modernize Renovate config (#921)

Modernizes the Renovate config to the current schema. Renovate v36+
renamed several options, and `renovate-config-validator --strict`
reported that the config needs migration. Applies exactly the migrations
the validator prescribes:

- `config:base` → `config:recommended`
- `pinVersions: false` → `rangeStrategy: "replace"`
- `matchPaths` → `matchFileNames`

Also fixes the inconsistent indentation of the last `packageRules` entry
(10 → 12 spaces).

No behavior change: after the change the config validates cleanly
(`Config validated successfully`), whereas before it emitted `Config
migration necessary`.